{"id":4507,"date":"2016-09-07T15:52:09","date_gmt":"2016-09-07T15:52:09","guid":{"rendered":"https:\/\/wordpress.org\/news\/?p=4507"},"modified":"2022-11-18T22:53:15","modified_gmt":"2022-11-18T22:53:15","slug":"wordpress-4-6-1-security-and-maintenance-release","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2016\/09\/wordpress-4-6-1-security-and-maintenance-release\/","title":{"rendered":"WordPress 4.6.1 Security and Maintenance Release"},"content":{"rendered":"<p>WordPress 4.6.1 is now available. This is a <strong>security release<\/strong> for all previous versions and we strongly encourage you to update your sites immediately.<\/p>\n<p>WordPress versions 4.6 and earlier are affected by two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher <a href=\"https:\/\/twitter.com\/cengizhansahin\">Cengiz Han Sahin<\/a>; and a path traversal vulnerability in the upgrade package uploader, reported by <a href=\"https:\/\/dominikschilling.de\/\">Dominik Schilling<\/a> from the WordPress security team.<\/p>\n<p>Thank you to the\u00a0reporters for practicing <a href=\"https:\/\/make.wordpress.org\/core\/handbook\/testing\/reporting-security-vulnerabilities\/\">responsible disclosure<\/a>.<\/p>\n<p>In addition to the security issues above, WordPress 4.6.1 fixes 15 bugs from 4.6.\u00a0For more information, see the <a href=\"https:\/\/codex.wordpress.org\/Version_4.6.1\">release notes<\/a>\u00a0or consult the <a href=\"https:\/\/core.trac.wordpress.org\/query?milestone=4.6.1\">list of changes<\/a>.<\/p>\n<p><a href=\"https:\/\/wordpress.org\/download\/\">Download WordPress 4.6.1<\/a>\u00a0or venture over to Dashboard \u2192 Updates and simply click \u201cUpdate Now.\u201d Sites that support automatic background updates are already beginning to update to WordPress 4.6.1.<\/p>\n<p>Thanks to everyone who contributed to 4.6.1:<\/p>\n<p><a href=\"https:\/\/profiles.wordpress.org\/azaozz\/\">Andrew Ozz<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/gitlost\/\">bonger<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/boonebgorges\/\">Boone Gorges<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/chaos-engine\/\">Chaos Engine<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/danielkanchev\/\">Daniel Kanchev<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dd32\/\">Dion Hulse<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/drewapicture\/\">Drew Jaynes<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/flixos90\/\">Felix Arntz<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/frozzare\/\">Fredrik Forsmo<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/pento\/\">Gary Pendergast<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/geminorum\/\">geminorum<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/iandunn\/\">Ian Dunn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ionutst\/\">Ionut Stanciu<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jeremyfelt\/\">Jeremy Felt<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joemcgill\/\">Joe McGill<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/clorith\/\">Marius L. J. (Clorith)<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/swissspidy\/\">Pascal Birchler<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/rpayne7264\/\">Robert D Payne<\/a>,\u00a0<a href=\"https:\/\/profiles.wordpress.org\/sergeybiryukov\/\">Sergey Biryukov<\/a>, and\u00a0<a href=\"https:\/\/profiles.wordpress.org\/nmt90\/\">Triet Minh<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress 4.6.1 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.6 and earlier are affected by two security issues: a cross-site scripting vulnerability via image filename, reported by SumOfPwn researcher Cengiz Han Sahin; and a path traversal vulnerability in [&hellip;]<\/p>\n","protected":false},"author":4238663,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","date_recorded":"","explicit":"","block":"","filesize_raw":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15],"tags":[182,437],"class_list":["post-4507","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","tag-4-6","tag-minor-releases"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-1aH","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4507","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/4238663"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=4507"}],"version-history":[{"count":7,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4507\/revisions"}],"predecessor-version":[{"id":13942,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4507\/revisions\/13942"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=4507"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=4507"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=4507"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}