WordPress 5.2.4 Security Release, Quick Update your WordPress Site!
WordPress 5.2.4 Security Update Release and earlier are affected by these bugs, Please update your WordPress site
This security release fixes 6 security issues.
- Props to Evan Ricafort for finding an issue where stored XSS (cross-site scripting) could be added via the Customizer.
- Props to J.D. Grimes who found and disclosed a method of viewing unauthenticated posts.
- Props to David Newman for highlighting a method to poison the cache of JSON GET requests via the Vary: Origin header.
- Props to Eugene Kolodenker who found a server-side request forgery in the way that URLs are validated.
- Props to Ben Bidner of the WordPress Security Team who discovered issues related to referrer validation in the admin.
You can download WordPress 5.2.4 or visit
Dashboard → Updates and click
Update Now. Sites that support automatic background updates have already started to update automatically.
View the full list of changes on the 5.2.4 documentation page.
June 26, 2018