Wordpress 2.8.6 Security Update

The Wordpress developers have just released a security update for their blogging platform Wordpress which raises the version of the software to 2.8.6. It is always recommended to update to a new version of Wordpress as soon as possible and especially so for a security release. This release fixes two vulnerabilities that are only relevant for multi-author blogs as they can only be exploited by registered, logged in users with posting rights. This security vulnerability is therefor not affecting the majority of Wordpress blogs but those webmasters should nevertheless consider upgrading their blog software right away.

The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations. Thanks to Benjamin and Dawid for finding and reporting these.

The upgrade is as usual available through various means with the two most popular ones being through an automatic update in the Wordpress admin interface and the second trough a download from the official Wordpress website. The first is faster and more comfortable while the second offers more control to the user especially if something goes wrong.

This Wordpress update does not require an update of the Wordpress database. It is however recommended to perform a backup of both the Wordpress files on the web server and the MySQL database to be prepared if the update should fail for any reason.

• Reddit
• StumbleUpon
• Delicious
• Digg
• Twitter

Tags: wordpress, wordpress 2.8.6, wordpress security, wordpress update
Categories: The Web

Related posts:

5 Responses to “Wordpress 2.8.6 Security Update”

1. Harsh Agrawal says:

   November 13, 2009 at 4:05 am

   This update was really unexpected.. though this update seems to be only for those
   who have multi author blogs or is it for every one?

   Reply
   • Martin says:

     November 13, 2009 at 10:44 am

     Seems to be only for blogs with at least two users with posting rights. But I would update nevertheless.

     Reply

Trackbacks/Pingbacks

1. Wordpress 2.8.6 Security Update - Ghacks Technology News | ByteBooth says:

   November 13, 2009 at 2:36 am

   [...] recommended to update to a new version of Wordpress as soon as possible and especially … … read more (No Ratings Yet)  Loading … [...]

   Reply
2. Wordpress 2.8.6 Security Update - Ghacks Technology News | ByteBooth says:

   November 13, 2009 at 4:38 am

   [...] recommended to update to a new version of Wordpress as soon as possible and especially … Read Full Article (No Ratings Yet)  Loading … Word [...]

   Reply
3. Wordpress 2.8.6 cerrará dos agujeros de seguridad | Malavida Blog says:

   November 13, 2009 at 9:36 am

   [...] Fuente: gHacks [...]

   Reply