Update Feed

WordPress 4.0.2

21 April 2015

WordPress version 4.0.2 is now available (security release).

Upgrading to WordPress 4.0.2

WordPress 4.0.2 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply WordPress updates as new versions are released, or use Installatron's Clone feature to duplicate an existing WordPress install to test the 4.0.2 upgrade prior to applying it live. Get started managing your WordPress installations with Installatron

What's New in WordPress 4.0.2

This is a critical security release for all previous versions. Furthermore, a number of plugins released security fixes yesterday. Keep everything updated to stay secure.

WordPress versions 4.1.1 and earlier are affected by a critical cross-site scripting vulnerability, which could enable anonymous users to compromise a site. This was reported by Cedric Van Bockhaven and fixed by Gary Pendergast, Mike Adams, and Andrew Nacin of the WordPress security team.

We also fixed three other security issues:

In WordPress 4.1 and higher, files with invalid or unsafe names could be uploaded. Discovered by Michael Kapfer and Sebastian Kraemer of HSASec.
In WordPress 3.9 and higher, a very limited cross-site scripting vulnerability could be used as part of a social engineering attack. Discovered by Jakub Zoczek.
Some plugins were vulnerable to an SQL injection vulnerability. Discovered by Ben Bidner of the WordPress security team.

We also made four hardening changes, discovered by J.D. Grimes, Divyesh Prajapati, Allan Collins and Marc-Alexandre Montpas.