WordPress 7.0.2 Security Update: Fixes SQL Injection and RCE Vulnerabilities

Vulnerability Overview WordPress version 7.0.2 has been released, addressing one critical and one high-severity security vulnerability. Impact Scope WordPress 6.9: Affected by both vulnerabilities. WordPress 6.8: Affected only by the first vulnerability. WordPress 7.1 beta: Affected by both vulnerabilities. WordPress 6.8 and earlier versions: Not affected. Remediation Steps Automatic Updates: The WordPress.org team has enabled forced updates for affected versions. Manual Updates: Users can access the WordPress dashboard, click "Updates," and then select "Update Now." Alternatively, download WordPress 7.0.2 from WordPress.org. Automatic Background Updates: Sites supporting automatic background updates will automatically initiate the update process. Security Update Details SQL Injection: Reported by the TF11, dtro, and haongo teams. REST API Bulk Route Confusion and SQL Injection Leading to Remote Code Execution: Reported by Adam Kues. Acknowledgments Thanks to the following individuals for responsibly reporting vulnerabilities: Aaron Jorbin Alex Concha annezzazu Barry David Baumwald Dominik Schilling Ehtisham Siddiqui Joe Dolson Joe Hoyle John Blackbourn Jonathan Desrosiers Marius L. J. Matt Mullenweg Mohammad Janjua Peter Wilson Sergey Biryukov vortfu Weston Ruter Contributors John Blackbourn Barry Abrahamson Other Contributors Automattic Bluehost Cloudflare GoDaddy Hostinger WP Engine Share Share buttons are provided at the bottom of the page, including Twitter, Facebook, LinkedIn, and others. Subscribe and Contribute Subscribe to WordPress News: Email subscription functionality is available. Contribute to WordPress: As WordPress is open-source software, contributions are encouraged through code, design, documentation, and other means. Footer Includes links such as About, News, Hosting, Privacy, Showcase, Themes, Plugins, Patterns, Learn, Documentation, Developers, WordPress.tv, Get Involved, Events, Donate, For the Future, and more.

Goal Reached Thanks to every supporter — we hit 100%!

WordPress 7.0.2 Security Update: Fixes SQL Injection and RCE Vulnerabilities

More from this source