WordPress 4.7.5 is now available. This is a�security release�for all previous versions and we strongly encourage you to update your sites immediately.

WordPress versions 4.7.4 and earlier are affected by six security issues:

  1. Insufficient redirect validation in the HTTP class. Reported by�Ronni Skansing.
  2. Improper handling of post meta data values in the XML-RPC API. Reported by�Sam Thomas.
  3. Lack of capability checks for post meta data in the XML-RPC API. Reported by�Ben Bidner�of the WordPress Security Team.
  4. A Cross Site Request Forgery (CSRF) �vulnerability was discovered in the filesystem credentials dialog. Reported by�Yorick Koster.
  5. A cross-site scripting (XSS) vulnerability was discovered when attempting to upload very large files.�Reported by�Ronni Skansing.
  6. A cross-site scripting (XSS) vulnerability was discovered related to the Customizer. Reported by�Weston Ruter�of the WordPress Security Team.

Thank you to the reporters of these issues for practicing�responsible disclosure.

In addition to the security issues above, WordPress 4.7.5 contains 3 maintenance fixes to the�4.7 release series.�For more information, see the�release notes�or consult the�list of changes.



Wednesday, May 17, 2017





« Back