+44 0330 223 3428
Call Us
+44 0330 223 3428

Dev Blog: WordPress 4.8.2 Security and Maintenance Release

Dev Blog: WordPress 4.8.2 Security and Maintenance Release

WordPress 4.8.2 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.8.1 and earlier are affected by these security issues:

  1. $wpdb->prepare() can create unexpected and unsafe queries leading to potential SQL injection (SQLi). WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability. Reported by Slavco
  2. A cross-site scripting (XSS) vulnerability was discovered in the oEmbed discovery. Reported by xknown of the WordPress Security Team.
  3. A cross-site scripting (XSS) vulnerability was discovered in the visual editor. Reported by Rodolfo Assis (@brutelogic) of Sucuri Security.
  4. A path traversal vulnerability was discovered in the file unzipping code. Reported by Alex Chapman (noxrnet).
  5. A cross-site scripting (XSS) vulnerability was discovered in the plugin editor. Reported by 陈瑞琦 (Chen Ruiqi).
  6. An open redirect was discovered on the user and term edit screens. Reported by Yasin Soliman (ysx).
  7. A path traversal vulnerability was discovered in the customizer. Reported by Weston Ruter of the WordPress Security Team.
  8. A cross-site scripting (XSS) vulnerability was discovered in template names. Reported by Luka (sikic).
  9. A cross-site scripting (XSS) vulnerability was discovered in the link modal. Reported by Anas Roubi (qasuar).

Thank you to the reporters of these issues for practicing responsible disclosure.

In addition to the security issues above, WordPress 4.8.2 contains 6 maintenance fixes to the 4.8 release series. For more information, see the release notes or consult the list of changes.

Download WordPress 4.8.2 or venture over to Dashboard → Updates and simply click “Update Now.” Sites that support automatic background updates are already beginning to update to WordPress 4.8.2.

Thanks to everyone who contributed to 4.8.2.



Source: WordPress

Related Post
Post Status: Why the makers of Ninja Forms are getting into eCommerce

Post Status: Why the makers of Ninja Forms are getting into eCommerce Welcome to the Post Status Draft podcast, which you can find on iTunes, Google Play, Stitcher, and via RSS for your favorite podcatcher. Post Status Draft is hosted by Brian Krogsgard and co-host Brian Richards. In this episode, I bring on James Laws […]

Read more
WPTavern: WordPress 4.9.8 Will Significantly Reduce Memory Leak

WPTavern: WordPress 4.9.8 Will Significantly Reduce Memory Leak WordPress 4.9.8 Beta two recently shipped and although much of the focus will be on the “Try Gutenberg” call-out, there’s a patch included that addresses a memory leak that was quite a problem for some users. When WordPress 4.9.7 shipped, the WordPress.org support forums saw an increase in […]

Read more
Donncha: WP Super Cache and Cookie Banners

Donncha: WP Super Cache and Cookie Banners More sites use cookie banners now that the GDPR is active but some are finding that their banners are misbehaving once they enable caching. This is a similar issue to the one that happened to some page counter plugins in the past. The page counter wouldn’t increment. When […]

Read more