{"id":13618,"date":"2022-10-17T22:55:55","date_gmt":"2022-10-17T22:55:55","guid":{"rendered":"https:\/\/wordpress.org\/news\/?p=13618"},"modified":"2022-10-17T22:55:55","modified_gmt":"2022-10-17T22:55:55","slug":"wordpress-6-0-3-security-release","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2022\/10\/wordpress-6-0-3-security-release\/","title":{"rendered":"WordPress 6.0.3 Security Release"},"content":{"rendered":"\n<p><strong>WordPress 6.0.3<\/strong> is now available!<\/p>\n\n\n\n<p>This release features several security fixes. Because this is a <strong>security release<\/strong>, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.<\/p>\n\n\n\n<p>WordPress 6.0.3 is a short-cycle release. The next major release will be <a href=\"https:\/\/make.wordpress.org\/core\/6-1\/\">version 6.1<\/a> planned for November 1, 2022.<\/p>\n\n\n\n<p>If you have sites that support automatic background updates, the update process will begin automatically.<\/p>\n\n\n\n<p>You can <a href=\"https:\/\/wordpress.org\/wordpress-6.0.3.zip\">download WordPress 6.0.3 from WordPress.org<\/a>, or visit your WordPress Dashboard, click \u201cUpdates\u201d, and then click \u201cUpdate Now\u201d.<\/p>\n\n\n\n<p>For more information on this release, please <a href=\"https:\/\/wordpress.org\/support\/wordpress-version\/version-6-0-3\">visit the HelpHub site<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Security updates included in this release<\/h2>\n\n\n\n<p>The security team would like to thank the following people for responsibly reporting vulnerabilities, and allowing them to be fixed in this release.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Stored XSS via wp-mail.php (post by email) &#8211; Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT<\/li>\n\n\n\n<li>Open redirect in `wp_nonce_ays` &#8211; <a href=\"https:\/\/hackerone.com\/devrayn\">devrayn<\/a><\/li>\n\n\n\n<li>Sender&#8217;s email address is exposed in wp-mail.php &#8211; Toshitsugu Yoneyama of Mitsui Bussan Secure Directions, Inc. via JPCERT<\/li>\n\n\n\n<li>Media Library &#8211; Reflected XSS via SQLi &#8211; Ben Bidner from the WordPress security team and Marc Montpas from Automattic independently discovered this issue<\/li>\n\n\n\n<li>CSRF in wp-trackback.php &#8211; Simon Scannell<\/li>\n\n\n\n<li>Stored XSS via the Customizer &#8211; Alex Concha from the WordPress security team<\/li>\n\n\n\n<li>Revert shared user instances introduced in <a href=\"https:\/\/core.trac.wordpress.org\/changeset\/50790\">50790<\/a> &#8211; Alex Concha and Ben Bidner from the WordPress security team<\/li>\n\n\n\n<li>Stored XSS in WordPress Core via Comment Editing &#8211; Third-party security audit and Alex Concha from the WordPress security team<\/li>\n\n\n\n<li>Data exposure via the REST Terms\/Tags Endpoint &#8211; Than Taintor<\/li>\n\n\n\n<li>Content from multipart emails leaked &#8211; <a href=\"https:\/\/profiles.wordpress.org\/kraftner\">Thomas Kr\u00e4ftner<\/a><\/li>\n\n\n\n<li>SQL Injection due to improper sanitization in `WP_Date_Query` &#8211; <a href=\"https:\/\/www.gold-network.ch\">Michael Mazzolini<\/a><\/li>\n\n\n\n<li>RSS Widget: Stored XSS issue &#8211; Third-party security audit<\/li>\n\n\n\n<li>Stored XSS in the search block &#8211; Alex Concha of the WP Security team<\/li>\n\n\n\n<li>Feature Image Block: XSS issue &#8211; Third-party security audit<\/li>\n\n\n\n<li>RSS Block: Stored XSS issue &#8211; Third-party security audit<\/li>\n\n\n\n<li>Fix widget block XSS &#8211; Third-party security audit<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Thank you to these WordPress contributors<\/h2>\n\n\n\n<p>This release was led by <a href=\"https:\/\/profiles.wordpress.org\/xknown\">Alex Concha<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/peterwilsoncc\">Peter Wilson<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/audrasjb\">Jb Audras<\/a>, and <a href=\"https:\/\/profiles.wordpress.org\/SergeyBiryukov\">Sergey Biryukov<\/a> at mission control. Thanks to <a href=\"https:\/\/profiles.wordpress.org\/desrosj\/\">Jonathan Desrosiers<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jorgefilipecosta\/\">Jorge Costa<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/bernhard-reiter\/\">Bernie Reiter<\/a> and <a href=\"https:\/\/profiles.wordpress.org\/cbravobernal\/\">Carlos Bravo<\/a> for their help on package updates.<\/p>\n\n\n\n<p>WordPress 6.0.3 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver several fixes into a stable release is a testament to the power and capability of the WordPress community.<\/p>\n\n\n\n<p class=\"is-style-default\"><a href=\"https:\/\/profiles.wordpress.org\/xknown\/\">Alex Concha<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/costdev\/\">Colin Stewart<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/talldanwp\/\">Daniel Richards<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/davidbaumwald\/\">David Baumwald<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dd32\/\">Dion Hulse<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ehtis\/\">ehtis<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/voldemortensen\/\">Garth Mortensen<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/audrasjb\/\">Jb Audras<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/johnbillion\/\">John Blackbourn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/johnjamesjacoby\/\">John James Jacoby<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/desrosj\/\">Jonathan Desrosiers<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jorgefilipecosta\/\">Jorge Costa<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jrf\/\">Juliette Reinders Folmer<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/rudlinkon\/\">Linkon Miyan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/martinkrcho\/\">martin.krcho<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/matveb\/\">Matias Ventura<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mukesh27\/\">Mukesh Panchal<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/paulkevan\/\">Paul Kevan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/peterwilsoncc\/\">Peter Wilson<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/noisysocks\/\">Robert Anderson<\/a><a href=\"https:\/\/profiles.wordpress.org\/robinwpdeveloper\/\">Robin<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sergeybiryukov\/\">Sergey Biryukov<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sumitbagthariya16\/\">Sumit Bagthariya<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/tykoted\/\">Teddy Patriarca<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/timothyblynjacobs\/\">Timothy Jacobs<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/vortfu\/\">vortfu<\/a>, and <a href=\"https:\/\/profiles.wordpress.org\/chesio\/\">\u010ceslav Przywara<\/a>.<\/p>\n\n\n\n<p class=\"has-text-align-right has-small-font-size\"><em>Thanks to <a href='https:\/\/profiles.wordpress.org\/peterwilsoncc\/' class='mention'><span class='mentions-prefix'>@<\/span>peterwilsoncc<\/a> for proofreading.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress 6.0.3 is now available! This release features several security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated. WordPress 6.0.3 is a short-cycle release. The next major release will be version 6.1 planned for November 1, 2022. If [&hellip;]<\/p>\n","protected":false},"author":8670591,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","date_recorded":"","explicit":"","block":"","filesize_raw":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15],"tags":[],"class_list":["post-13618","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","mentions-peterwilsoncc"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-3xE","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/13618","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/8670591"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=13618"}],"version-history":[{"count":20,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/13618\/revisions"}],"predecessor-version":[{"id":13643,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/13618\/revisions\/13643"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=13618"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=13618"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=13618"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}