Webmaster Forum

[Wallace]

Dear Guest, please register and confirm your
account to remove these advertisements.

The Wordpress developers have just released a security update which raises the version of the software to 2.8.6. It is always recommended to update to a new version of Wordpress as soon as possible and especially so for a security release. This release fixes two vulnerabilities that are only relevant for multi-author blogs as they can only be exploited by registered, logged in users with posting rights.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

The upgrade is as usual that you can automatic update in the WordPress admin dashboard. 2.8.6 update version does not require an update of the WordPress database. Anyway it's recommended to perform a backup of both the WordPress files on the web server and the MySQL database to be prepared if the update should fail for any reason.

WordPress › Blog WordPress 2.8.6 Security Release