WordPress 6.3.2 Security Update For 8 Vulnerabilities via @sejournal, @martinibuster

Important WordPress security release patches vulnerabilities, including one that could lead to a full site takeover The post WordPress 6.3.2 Security Update For 8 Vulnerabilities appeared first on Search Engine Journal.

Oct 13, 2023 - 21:04

0 15

WordPress 6.3.2 Security Update For 8 Vulnerabilities via @sejournal, @martinibuster

WordPress security release patches eight vulnerabilities, including one that could lead to a full site takeover

WordPress announced it was publishing a maintenance and security release that patches multiple vulnerabilities including one that could lead to a full site takeover.

Maintenance and Security Release WordPress 6.3.2

WordPress 6.3.2 delivers 41 bug fixes but more importantly it ships with patches for eight vulnerabilities.

The following eight vulnerabilities were recently discovered and patched:

A vulnerability in the WordPress core that allows arbitrary shortcode execution Potential disclosure of user email addresses by unauthenticated hackers using Remote code execution POP Chains vulnerability Cross-site scripting (XSS) vulnerability in the post link navigation block Leaked comment visibility on private posts Reflected cross-site scripting (XSS) vulnerability in the application passwords screen Cross-site scripting (XSS) vulnerability in the footnotes block Cache poisoning Denial of Service (DoS) vulnerability

Some of the vulnerabilities are due to insufficient input sanitization, which means that data that is submitted isn’t filtering out malicious inputs.

The official WordPress developer page for input sanitization informs:

“Untrusted data comes from many sources (users, third party sites, even your own database!) and all of it needs to be checked before it’s used.

Sanitizing input is the process of securing/cleaning/filtering input data.

Validation is preferred over sanitization because validation is more specific.

But when ‘more specific’ isn’t possible, sanitization is the next best thing.”

All of the vulnerabilities are rated as medium severity, including patches for five medium severity issues.

An advisory about the current security release posted by Wordfence notes that at least one of the vulnerabilities contained the potential for a full site takeover.

WordPress advises all users to verify that their WordPress installations are updated to the very latest version, WordPress version 6.3.2.

According to the official WordPress announcement:

“Because this is a security release, it is recommended that you update your sites immediately.

Backports are also available for other major WordPress releases, 4.1 and later.”

Read the official WordPress security release announcement:

WordPress 6.3.2 – Maintenance and Security release

Featured Image by Shutterstock/Light_Lenser

SEJ STAFF Roger Montti Owner - Martinibuster.com at Martinibuster.com

Roger Montti is a search marketer with over 20 years experience. I offer site audits and phone consultations. See me ...