Automattic has just released the new version of WordPress 4.6.1. It is a security update, as previous versions from WordPress 4.6 onwards are affected by two security vulnerabilities:
A cross-site scripting (XSS) via an image file, reported by SumOfPwn researcher Cengiz Han Sahin
, and a path traversal in the upgrade package uploader, reported by Dominik Schilling from the WordPress security team.
WordPress version 4.6.1 also fixes 15 bugs from version 4.6 which you can see at the link below:
Files that changed:
wp-admin/about.php wp-admin/js/editor-expand.js wp-admin/js/editor-expand.min.js wp-admin/includes/media.php wp-admin/includes/class-file-upload-upgrader.php wp-admin/includes/class-language-pack-upgrader.php wp-includes/wp-db.php wp-includes/pluggable.php wp-includes/script-loader.php wp-includes/general-template.php wp-includes/css/editor.css wp-includes/css/editor.min.css wp-includes/css/editor-rtl.css wp-includes/css/editor-rtl.min.css wp-includes/functions.php wp-includes/class-wp-editor.php wp-includes/load.php wp-includes/version.php wp-includes/class-http.php wp-includes/js/tinymce/skins/wordpress/wp-content.css wp-includes/js/jquery/jquery.masonry.min.js wp-includes/Requests/Transport/cURL.php wp-includes/revision.php wp-content/plugins readme.html
📧
Subscribe to the SecNews Newsletter
