{"id":4650,"date":"2017-01-11T03:53:57","date_gmt":"2017-01-11T03:53:57","guid":{"rendered":"https:\/\/wordpress.org\/news\/?p=4650"},"modified":"2022-11-18T22:53:15","modified_gmt":"2022-11-18T22:53:15","slug":"wordpress-4-7-1-security-and-maintenance-release","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2017\/01\/wordpress-4-7-1-security-and-maintenance-release\/","title":{"rendered":"WordPress 4.7.1 Security and Maintenance Release"},"content":{"rendered":"

WordPress 4.7 has been\u00a0downloaded over 10 million times<\/a>\u00a0since its release on December 6, 2016\u00a0and we are pleased to announce the immediate availability of WordPress 4.7.1. This is a security release<\/strong> for all previous versions and we strongly encourage you to update your sites immediately.<\/p>\n

WordPress versions 4.7 and earlier are affected by eight security issues:<\/p>\n

    \n
  1. Remote code execution (RCE) in PHPMailer – No specific issue appears to affect WordPress<\/em> or any of the major plugins we investigated but, out of an abundance of caution, we updated PHPMailer in this release. This issue was fixed in PHPMailer thanks to Dawid Golunski<\/a> and Paul Buonopane<\/a>.<\/li>\n
  2. The REST API exposed user data for all users who had authored a post of a public post type. WordPress 4.7.1 limits this to only\u00a0post types which have specified that they should be shown\u00a0within the REST API. Reported by Krogsgard<\/a> and Chris Jean<\/a>.<\/li>\n
  3. Cross-site scripting (XSS) via the plugin name or version header on update-core.php<\/code>.\u00a0Reported by\u00a0Dominik Schilling<\/a>\u00a0of the WordPress Security Team.<\/li>\n
  4. Cross-site request forgery (CSRF) bypass via uploading a Flash file. Reported by\u00a0Abdullah Hussam<\/a>.<\/li>\n
  5. Cross-site scripting (XSS) via theme name fallback. Reported by\u00a0Mehmet Ince<\/a>.<\/li>\n
  6. Post via email checks mail.example.com<\/code>\u00a0if default settings aren’t changed. Reported by John Blackbourn of the WordPress Security Team.<\/li>\n
  7. A cross-site request forgery (CSRF) was discovered in the accessibility mode of widget editing. Reported by\u00a0Ronnie Skansing<\/a>.<\/li>\n
  8. Weak cryptographic security for multisite activation key. Reported by Jack<\/a>.<\/li>\n<\/ol>\n

    Thank you to the\u00a0reporters for practicing responsible disclosure<\/a>.<\/p>\n

    In addition to the security issues above, WordPress 4.7.1 fixes 62\u00a0bugs from 4.7.\u00a0For more information, see the release notes<\/a>\u00a0or consult the list of changes<\/a>.<\/p>\n

    Download WordPress 4.7.1<\/a>\u00a0or venture over to Dashboard \u2192 Updates and simply click \u201cUpdate Now.\u201d Sites that support automatic background updates are already beginning to update to WordPress 4.7.1.<\/p>\n

    Thanks to everyone who contributed to 4.7.1: Aaron D. Campbell<\/a>, Aaron Jorbin<\/a>, Adam Silverstein<\/a>, Andrea Fercia<\/a>, Andrew Ozz<\/a>, bonger<\/a>, Boone Gorges<\/a>, Chandra Patel<\/a>, Christian Chung<\/a>, David Herrera<\/a>, David Shanske<\/a>, Dion Hulse<\/a>, Dominik Schilling (ocean90)<\/a>, DreamOn11<\/a>, Edwin Cromley<\/a>, Ella van Dorpe<\/a>, Gary Pendergast<\/a>, Hristo Pandjarov<\/a>, James Nylen<\/a>, Jeff Bowen<\/a>, Jeremy Felt<\/a>, Jeremy Pry<\/a>, Joe Hoyle<\/a>, Joe McGill<\/a>, John Blackbourn<\/a>, Keanan Koppenhaver<\/a>, Konstantin Obenland<\/a>, laurelfulford<\/a>, Marin Atanasov<\/a>, mattyrob<\/a>, monikarao<\/a>, Nate Reist<\/a>, Nick Halsey<\/a>, Nikhil Chavan<\/a>, nullvariable<\/a>, Payton Swick<\/a>, Peter Wilson<\/a>, Presskopp<\/a>, Rachel Baker<\/a>, Ryan McCue<\/a>, Sanket Parmar<\/a>, Sebastian Pisula<\/a>, sfpt<\/a>, shazahm1<\/a>, Stanimir Stoyanov<\/a>, Steven Word<\/a>, szaqal21<\/a>, timph<\/a>, voldemortensen<\/a>, vortfu<\/a>, and Weston Ruter<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

    WordPress 4.7 has been\u00a0downloaded over 10 million times\u00a0since its release on December 6, 2016\u00a0and we are pleased to announce the immediate availability of WordPress 4.7.1. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7 and earlier are affected by eight security issues: […]<\/p>\n","protected":false},"author":140668,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","date_recorded":"","explicit":"","block":"","filesize_raw":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15],"tags":[189,437],"class_list":["post-4650","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","tag-4-7","tag-minor-releases"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-1d0","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/140668"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=4650"}],"version-history":[{"count":21,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4650\/revisions"}],"predecessor-version":[{"id":4675,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/4650\/revisions\/4675"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=4650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=4650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=4650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}