WordPress 6.0.2 Patches Vulnerability That Could Impact Millions of Legacy Sites

guest · Sep 3, 2022

By Ionut Arghire - August 31, 2022

The WordPress team this week announced the release of version 6.0.2 of the content management system (CMS), with patches for three security bugs, including a high-severity SQL injection vulnerability.

Identified in the WordPress Link functionality, previously known as ‘Bookmarks’, the issue only impacts older installations, as the capability is disabled by default on new installations.
However, the functionality might still be enabled on millions of legacy WordPress sites even if they are running newer versions of the CMS, the Wordfence team at WordPress security company Defiant says.
Click to expand...

With a CVSS score of 8.0, the security flaw requires administrative privileges and is not easy to exploit in default configurations, but there might be plugins or themes that allow it to be triggered by users with lower privileges (such as editor-level and below), Wordfence says.

“Vulnerable versions of WordPress failed to successfully sanitize the limit argument of the link retrieval query in the get_bookmarks function, used to ensure that only a certain number of links were returned,” Wordfence explains.
Click to expand...

Website administrators are advised to update to WordPress 6.0.2 as soon as possible (the update is being automatically delivered to sites that support background updates). The patches have been backported to WordPress 3.7 and newer versions, the WordPress team notes.
Click to expand...

WordPress Core 6.0.2 Security & Maintenance Release – What You Need to Know

By Ram Gall - August 30, 2022
On August 30, 2022, the WordPress core team released WordPress version 6.0.2, which contains patches for 3 vulnerabilities, including a High Severity SQLi vulnerability in the Links functionality as well as two Medium Severity Cross-Site Scripting vulnerabilities.

These patches have been backported to every version of WordPress since 3.7. WordPress has supported automatic core updates for security releases since WordPress 3.7, and the vast majority of WordPress sites should receive a patch for their major version of WordPress automatically over the next 24 hours.
Click to expand...

Log in or Sign up

WordPress 6.0.2 Patches Vulnerability That Could Impact Millions of Legacy Sites

guest Guest

Log in or Sign up

WordPress 6.0.2 Patches Vulnerability That Could Impact Millions of Legacy Sites

guest Guest

Useful Searches