WordPress 5.2.4 Released with the Fix for 6 Security Vulnerabilities

WordPress 5.2.4 released for public use from today, WordPress is the most popular content management system used by several websites around the world.

According to the stats report, WordPress shares 34% of the websites on the Internet. It holds 60% of the CMS market share.

WordPress 5.2.4

Today WordPress released 5.2.4, which mainly contains the security fixes. According to WordPress, this is a security update before WordPress major updates. WordPress 5.3 will be the final update in 2019 and that is scheduled on 12 November 2019.

The security update resolves multiple XSS, unauthenticated posts request, cache poison, server-side request forgery, and validation issues.

• Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.
• Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.
• Props to Weston Ruter for finding a way to create a stored XSS to inject Javascript into style tags.
• Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary: Origin header.
• Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.
• Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.

Administrators can install the update automatically from the Dashboards itself or alternatievely you can download the WordPress.

Dashboard → Updates and click Update Now.

It is always recommended to backup the database before pushing updates.

You can follow us on Linkedin, Twitter, Facebook for daily Cyber Security and hacking news updates.

Also Read: Cyber Security Firm “Sophos” Sold for $3.9 Billion in Cash To Thoma Bravo