WordPress issued a security/maintenance release, version 4.7.5, and is now available for update.

This update addresses six security issues;

1. Insufficient redirect validation in the HTTP class.
2. Improper handling of post meta data values in the XML-RPC API.
3. Lack of capability checks for post meta data in the XML-RPC API.
4. A Cross Site Request Forgery (CRSF)  vulnerability was discovered in the filesystem credentials dialog.
5. A cross-site scripting (XSS) vulnerability was discovered when attempting to upload very large files.
6. A cross-site scripting (XSS) vulnerability was discovered related to the Customizer.

In addition to addressing the security vulnerabilities, WordPress 4.7.5 contains 3 maintenance fixes.

WordPress is recommending that you update your website immediately, but before you do make sure you have a full backup copy of your website files and database. You can download this latest version from WordPress.org or update your existing install by going to your Dashboard > Updates, and clicking the link to update.

You can learn more about this security release here.

Since Current Photographer provides Managed WordPress Hosting, our clients don’t have to worry about upgrading their websites to version 4.7.5, because we take care of that for them. We backup the website files and database, run the core update, and then confirm the website is loading properly before going live. If we detect a problem, we’ll automatically roll it back to the state it was prior to the update and inform our clients of the issue. Automatic WordPress core updates is just one of the great features you get with our Hosting and Support plans.

Trevor Current

Founder of Current Photographer, co-host of The Digital Photography Cafe Show, Designer, Photographer, and overall tech geek.

currentphotographer.com

WordPress issued a security release, version 4.7.3, and is now available for update.

This update addresses six security issues;

1. Cross-site scripting (XSS) via media file metadata.
2. Control characters can trick redirect URL validation.
3. Unintended files can be deleted by administrators using the plugin deletion functionality.
4. Cross-site scripting (XSS) via video URL in YouTube embeds.
5. Cross-site scripting (XSS) via taxonomy term names.
6. Cross-site request forgery (CSRF) in Press This leading to excessive use of server resources.

In addition to addressing the security vulnerabilities, WordPress 4.7.3 contains 39 maintenance fixes.

You can download this latest version from WordPress.org or update your existing install by going to your Dashboard > Updates, and clicking the link to update.

You can learn more about this security release here.

Since Current Photographer provides Managed WordPress Hosting, our clients don’t have to worry about upgrading their websites to version 4.7.3, because we take care of that for them. We backup the website files and database, run the core update, and then confirm the website is loading properly before going live. If we detect a problem, we’ll automatically roll it back to the state it was prior to the update and inform our clients of the issue. Automatic WordPress core updates is just one of the great features you get with our Hosting and Support plans.

Trevor Current

Founder of Current Photographer, co-host of The Digital Photography Cafe Show, Designer, Photographer, and overall tech geek.

currentphotographer.com

WordPress issued a security release, version 4.7.2, and is now available for update.

This update addresses three security issues;

1. The user interface for assigning taxonomy terms in Press This is shown to users who do not have permissions to use it.
2. WP_Query is vulnerable to a SQL injection (SQLi) when passing unsafe data. WordPress core is not directly vulnerable to this issue, but we’ve added hardening to prevent plugins and themes from accidentally causing a vulnerability.
3. A cross-site scripting (XSS) vulnerability was discovered in the posts list table.

You can download this latest version from WordPress.org or update your existing install by going to your Dashboard > Updates, and clicking the link to update.

You can learn more about this security release here.

Since Current Photographer provides Managed WordPress Hosting, our clients don’t have to worry about upgrading their websites to version 4.7.2, because we take care of that for them. We backup the website files and database, run the core update, and then confirm the website is loading properly before going live. If we detect a problem, we’ll automatically roll it back to the state it was prior to the update and inform our clients of the issue. Automatic WordPress core updates is just one of the great features you get with our Hosting and Support plans.

Trevor Current

Founder of Current Photographer, co-host of The Digital Photography Cafe Show, Designer, Photographer, and overall tech geek.

currentphotographer.com