Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2022.6291
WordPress 6.0.3 Security Release
2 December 2022
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: WordPress
Publisher: WordPress
Operating System: Windows
UNIX variants (UNIX, Linux, OSX)
Resolution: Patch/Upgrade
Original Bulletin:
https://wordpress.org/news/2022/10/wordpress-6-0-3-security-release/
Comment: CVSS (Max): None available when published
- --------------------------BEGIN INCLUDED TEXT--------------------
WordPress 6.0.3 Security Release
WordPress 6.0.3 is now available!
This release features several security fixes. Because this is a security
release , it is recommended that you update your sites immediately. All
versions since WordPress 3.7 have also been updated.
WordPress 6.0.3 is a short-cycle release. The next major release will be
version 6.1 planned for November 1, 2022.
If you have sites that support automatic background updates, the update process
will begin automatically.
You can download WordPress 6.0.3 from WordPress.org , or visit your WordPress
Dashboard, click "Updates", and then click "Update Now".
For more information on this release, please visit the HelpHub site .
Security updates included in this release
The security team would like to thank the following people for responsibly
reporting vulnerabilities, and allowing them to be fixed in this release.
o Stored XSS via wp-mail.php (post by email) - Toshitsugu Yoneyama of Mitsui
Bussan Secure Directions, Inc. via JPCERT
o Open redirect in `wp_nonce_ays` - devrayn
o Sender's email address is exposed in wp-mail.php - Toshitsugu Yoneyama of
Mitsui Bussan Secure Directions, Inc. via JPCERT
o Media Library - Reflected XSS via SQLi - Ben Bidner from the WordPress
security team and Marc Montpas from Automattic independently discovered
this issue
o CSRF in wp-trackback.php - Simon Scannell
o Stored XSS via the Customizer - Alex Concha from the WordPress security
team
o Revert shared user instances introduced in 50790 - Alex Concha and Ben
Bidner from the WordPress security team
o Stored XSS in WordPress Core via Comment Editing - Third-party security
audit and Alex Concha from the WordPress security team
o Data exposure via the REST Terms/Tags Endpoint - Than Taintor
o Content from multipart emails leaked - Thomas Kraftner
o SQL Injection due to improper sanitization in `WP_Date_Query` - Michael
Mazzolini
o RSS Widget: Stored XSS issue - Third-party security audit
o Stored XSS in the search block - Alex Concha of the WP Security team
o Feature Image Block: XSS issue - Third-party security audit
o RSS Block: Stored XSS issue - Third-party security audit
o Fix widget block XSS - Third-party security audit
Thank you to these WordPress contributors
This release was led by Alex Concha , Peter Wilson , Jb Audras , and Sergey
Biryukov at mission control. Thanks to Jonathan Desrosiers , Jorge Costa ,
Bernie Reiter and Carlos Bravo for their help on package updates.
WordPress 6.0.3 would not have been possible without the contributions of the
following people. Their asynchronous coordination to deliver several fixes into
a stable release is a testament to the power and capability of the WordPress
community.
Alex Concha , Colin Stewart , Daniel Richards , David Baumwald , Dion Hulse ,
ehtis , Garth Mortensen , Jb Audras , John Blackbourn , John James Jacoby ,
Jonathan Desrosiers , Jorge Costa , Juliette Reinders Folmer , Linkon Miyan ,
martin.krcho , Matias Ventura , Mukesh Panchal , Paul Kevan , Peter Wilson ,
Robert Anderson Robin , Sergey Biryukov , Sumit Bagthariya , Teddy Patriarca ,
Timothy Jacobs , vortfu , and Ceslav Przywara .
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBY4mAZckNZI30y1K9AQgfBA/9Huk2MO0vzHBDi3BuM6Mr3kbyUkLw5HC+
ZQwtzmWgGvqKA460UHl2ZhdKbpGXmEVawNCV0LAa5b3ckZLdPzEks7As0PyjmelE
8lqfR43ubaB7KJ7vuIsKdYOLrA0hmNdIwZZVy2q371fZccnA/JLF+AWqtw60JpU+
733saI/NuL/eZE2LRmEuCOwBkrH/eot4MqmswDJRIy7wSnlV8rtJgBjcoSn2pTCr
GskDQ6N3vhKscg/FaNnaNIGeYer2XZssQk8w4SBMtpI2Oi8BTf4JY+kntembo75B
fSUirx4u/F5gCYr+GlS6EZ9B3tEcalOVnsi11TaViHsT4Yez31Vqc+0e4O8Dq39r
HZ6fOmRToL9qjQfseLVf83CmjyYkENnFR5gLoo8IUs4WHU0TFw6yRYZW3O/7+Rx8
TuooCSHkRjEBgaGth/qJafMaG/65kxQH4Re5+RF7LbUpeLOL2VH4ICSZhcyJTAcf
Voba/h5Z98uhfrPPfEu7sca5aAUXR9WWrda3WC6/HqI1b9s2v8POCcg1n4MuBpPc
UVIU/S8m1vtuh4o/kRdOWZg8KoigcYVLY8CbCHiT+bdK5A/LncE35lXYsB2+oU1e
UHm/IxPJCYiJN1C5e0Z7ceQFNWuMqIOXQyN4/cGQ4wFdZBSw5KVe9We1ihjIzLiX
6LQcrTU3QjM=
=EiOc
-----END PGP SIGNATURE-----