Cancel

Jeff Chandler

WordPress 4.7.1 Fixes Eight Security Issues

WordPress 4.7.1 is available for download and fixes eight security issues that affect WordPress 4.7 and below. The PHPMailer library was updated to patch a remote code execution (RCE) vulnerability. WordFence reported the vulnerability last month as critical and that it affects WordPress core.

However, in the announcement post for 4.7.1, Aaron Campbell, WordPress’ new Security Czar says that, “No specific issue appears to affect WordPress or any of the major plugins we investigated but, out of an abundance of caution, we updated PHPMailer in this release.” Dawid Golunski and Paul Buonopane are credited with responsibly disclosing the vulnerability.

WordPress 4.7.1 also fixes an issue where the REST API exposed user data for all users who authored a post of a public post type. This release limits this ability to only post types which have specified that they should be shown within the API. Brian Krogsgard and Chris Jean are credited with responsibly disclosing the vulnerability.

In addition to patching eight security issues, this release fixes 62 bugs. To see a full list of changes, visit the release notes page or you can view them on Trac. Sites should update automatically but if you’d like to update sooner, visit your site’s Dashboard, select Updates, and click the Update Now button.

Category:
Tags: , ,
6

6 responses to “WordPress 4.7.1 Fixes Eight Security Issues”

  1. In case anyone was wondering if GoDaddy has turned the corner and deserves a fresh look, sites hosted with their Managed WordPress hosting are still running 4.7. I can’t update my site to 4.7.1 because GoDaddy handles all the updates. Except they don’t seem to be able to do it.

    It took them two weeks to update from 4.61 to 4.7. When I contacted tech support, the first thing the agent recommend was that I change my hosting Managed WordPress hosting. I had to tell him that is what I already had and that is why I was contacting support. The agent then went on to say that GoDaddy’s WordPress experts haven’t determined if 4.7 was “safe and stable” quite yet and wouldn’t perform the update until they did.

    Create forum topic from comment

    • I apologize that the agent didn’t understand correctly or give you accurate information. I can tell you for sure that the upgrade to 4.7.1 started rolling out onto the GoDaddy Managed WordPress platform less than an hour after I released it. That process does take time because it has to roll out into many data centers and across many thousands of sites, but it started almost immediately, but they are certainly “able to do it” and we definitely knew it was safe and stable.

      Create forum topic from comment

      • If they can do it, then I recommend they do it immediately. Check that. It was WordPress that recommended the update be done immediately. It’s four days later, and my site still hasn’t had the security update performed. That’s unacceptable.

        I have another website hosted on GoDaddy, but it’s with cPanel hosting. I was able to do the update myself in less than two minutes. I can’t do that with my managed account. I have to wait for GoDaddy to do it. When I asked the agent on chat about switching my account from managed hosting to cPanel hosting, he informed me I would need to buy another cPanel hosting account and move the (non)managed site to the cPanel site. That’s ridiculous. GoDaddy not able or willing to do what I’m paying for should not be an opportunity on the part of GoDaddy to make another sale.

        GoDaddy has an awful reputation in the WordPress community. I listened to Gabriel Mays, head of WordPress products at GoDaddy, on WordPress Weekly episode #246. He spoke about GoDaddy changing things. It was that episode that made me want to give GoDaddy a second look. Big mistake.

        Since moving my personal site to GoDaddy, I’ve had two major issues. It took two weeks for GoDaddy to update WordPress from version 4.61 to 4.7. Now, I cannot get a security update installed. Both times I’ve reached out to GoDaddy support via chat. Both times GoDaddy leaders have told me the agent gave me the wrong information, first by Gab and now by you. Why then would I ever contact GoDaddy support again? They apparently cannot be trusted.

        Create forum topic from comment

  2. Hey Jeff,

    I just wanted to point out that the WordFence article you link, while saying “Affects WordPress” in the title, also says:

    There is no known exploit publicly available for WordPress core or any WordPress theme or plugin at this time.

    Going on 2.5 weeks later, there are still no known vulnerabilities in PHPMailer that were exploitable in WordPress core. We did upgrade the package anyway out of an abundance of caution.

    Create forum topic from comment

You may also like

Newsletter

Subscribe Via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.