WordPress 6.2.1 was released today. Those with automatic background updates enabled should see a notice in their email, as updates rolled out earlier today.
This is a maintenance and security release that includes important fixes for five security vulnerabilities outlined by core contributor and release co-lead Jb Audras:
- Block themes parsing shortcodes in user generated data
- A CSRF issue updating attachment thumbnails
- A flaw allowing XSS via open embed auto discovery
- Bypassing of KSES sanitization in block attributes for low privileged users
- A path traversal issue via translation files
The patches were backported to WordPress 4.1. Now that these vulnerabilities are public, it’s recommended that users update immediately.
WordPress 6.2.1 also includes 20 core bug fixes and 10 fixes for the block editor, all detailed with ticket numbers in the release candidate post.
What is the impact of these issues? Can new admin user be created? Can files be modified?