WordPress has released version 7.1.1, a security and maintenance update that fixes 11 vulnerabilities affecting the widely used content management system.
Website owners and administrators are urged to install the update immediately to reduce the risk of cross-site scripting, authorization bypass, information disclosure, path traversal, and content manipulation attacks.
The WordPress 7.1.1 release also includes 17 bug fixes for WordPress Core and 19 fixes for the Block Editor. Sites configured for automatic background updates should begin receiving the patch automatically.
Administrators managing manual updates can install the release through the WordPress Dashboard by opening Updates and selecting Update Now.
The update addresses multiple stored cross-site scripting, or XSS, vulnerabilities. One issue exists in the wpautop() function. It could allow an unauthenticated visitor to inject malicious script into content, subject to comment approval. If a malicious comment is approved and later viewed by another user, the injected code may run in that user’s browser.
WordPress Urges Update
Another stored XSS issue affects some themes that support custom headers. WordPress also fixed an HTML API vulnerability in the set_modifiable_text() function, where specially crafted abrupt-closing sequences could allow an attacker to break out of a comment context.
Several flaws could enable unauthorized actions or expose restricted information. A specially crafted URL could automatically install and preview an inactive theme from WordPress.org.
While the issue does not necessarily mean arbitrary theme installation from an attacker-controlled source, it could be abused to alter site behavior or expose administrators to unwanted theme previews.
The release also resolves an authenticated path traversal vulnerability in the WP REST Templates Controller, reported by Anthropic.
Path traversal flaws can potentially allow authenticated users to access or manipulate files and resources outside the intended directory path, depending on the affected component and deployment configuration.
Another fix prevents Contributor-level users and above from overwriting arbitrary posts. WordPress also patched missing authorization checks that could disclose draft or pending post slugs to contributors and expose the title of a private parent post through attachment metadata.
The XML-RPC interface received a security fix after researchers found that it could be used to publish customize_changeset posts while bypassing checks for the edit_css capability.
XML-RPC has historically been a high-interest target for WordPress attackers because it can expose remote publishing and administrative functions.
WordPress additionally fixed an issue where any authenticated user could reparent comments, including internal notes. In multi-user publishing environments, this could affect moderation workflows, comment organization, and the integrity of editorial records.
Security researchers responsibly reported the vulnerabilities, including Rafie Muhammad, Jeremy Felt, Paulos Yibelo, pwn.ai, Jesse McNeil, Anthropic, Ben Bidner, HDWSec, hermanhms, and viridis.
WordPress said the security fixes are being backported where required to supported security branches, currently including versions through 4.7. However, only the latest WordPress release receives active support, making version 7.1.1 the recommended deployment for production websites.
Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC
The post WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities appeared first on Cyber Security News.