====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN335
_____________________________________________________________________

DATE                : 11/06/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running WordPress versions prior to 5.4.2.

=====================================================================
https://wordpress.org/news/2020/06/wordpress-5-4-2-security-and-maintenance-release/
_____________________________________________________________________



Posted June 10, 2020 by Jake Spurlock. Filed under Releases, Security.

WordPress 5.4.2 is now available!

This security and maintenance release features 23 fixes and
enhancements. Plus, it adds a number of security fixes—see the list
below.

These bugs affect WordPress versions 5.4.1 and earlier; version 5.4.2
fixes them, so you’ll want to upgrade.

If you haven’t yet updated to 5.4, there are also updated versions of
5.3 and earlier that fix the bugs for you.


Security Updates

WordPress versions 5.4 and earlier are affected by the following bugs,
which are fixed in version 5.4.2. If you haven’t yet updated to 5.4,
there are also updated versions of 5.3 and earlier that fix the security
issues.

    Props to Sam Thomas (jazzy2fives) for finding an XSS issue where
authenticated users with low privileges are able to add JavaScript to
posts in the block editor.

    Props to Luigi – (gubello.me) for discovering an XSS issue where
authenticated users with upload permissions are able to add JavaScript
to media files.

    Props to Ben Bidner of the WordPress Security Team for finding an
open redirect issue in wp_validate_redirect().

    Props to Nrimo Ing Pandum for finding an authenticated XSS issue via
theme uploads.

    Props to Simon Scannell of RIPS Technologies for finding an issue
where set-screen-option can be misused by plugins leading to privilege
escalation.

    Props to Carolina Nymark for discovering an issue where comments
from password-protected posts and pages could be displayed under certain
conditions.


Thank you to all of the reporters for privately disclosing the
vulnerabilities. This gave the security team time to fix the
vulnerabilities before WordPress sites could be attacked.


One maintenance update was also deployed to versions 5.1, 5.2 and 5.3.
See the related developer note for more information.

You can browse the full list of changes on Trac.

For more info, browse the full list of changes on Trac or check out the
Version 5.4.2 documentation page.

WordPress 5.4.2 is a short-cycle maintenance release. The next major
release will be version 5.5.

You can download WordPress 5.4.2 from the button at the top of this
page, or visit your Dashboard → Updates and click Update Now.

If you have sites that support automatic background updates, they’ve
already started the update process.


Thanks and props!

In addition to the security researchers mentioned above, thank you to
everyone who helped make WordPress 5.4.2 happen:

Andrea Fercia, argentite, M Asif Rahman, Jb Audras, Ayesh Karunaratne,
bdcstr, Delowar Hossain, Rob Migchels, donmhico, Ehtisham Siddiqui,
Emilie LEBRUN, finomeno, garethgillman, Giorgio25b, Gabriel Maldonado,
Hector F, Ian Belanger, Aaron Jorbin, Mathieu Viet, Javier Casares, Joe
McGill, jonkolbert, Jono Alderson, Joy, Tammie Lister, Kjell Reigstad,
KT, markusthiel, Mayank Majeji, Mel Choyce-Dwan, mislavjuric, Mukesh
Panchal, Nikhil Bhansi, oakesjosh, Dominik Schilling, Arslan Ahmed,
Peter Wilson, Carolina Nymark, Stephen Bernhardt, Sam Fullalove, Alain
Schlesser, Sergey Biryukov, skarabeq, Daniel Richards, Toni Viemerö,
suzylah, Timothy Jacobs, TeBenachi, Jake Spurlock and yuhin.


=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================