Update Feed

WordPress 4.2.4

4 August 2015

WordPress version 4.2.4 is now available (security release).

Upgrading to WordPress 4.2.4

WordPress 4.2.4 can be upgraded to (or installed) using any of Installatron's products. Use Installatron's optional Automatic Update feature to automatically apply WordPress updates as new versions are released, or use Installatron's Clone feature to duplicate an existing WordPress install to test the 4.2.4 upgrade prior to applying it live. Get started managing your WordPress installations with Installatron

What's New in WordPress 4.2.4

This is a security release for all previous versions and we strongly encourage you to update your sites immediately.

This release addresses six issues, including three cross-site scripting vulnerabilities and a potential SQL injection that could be used to compromise a site, which were discovered by Marc-Alexandre Montpas of Sucuri, Helen Hou-Sandí of the WordPress security team, Netanel Rubin of Check Point, and Ivan Grigorov. It also includes a fix for a potential timing side-channel attack, discovered by Johannes Schmitt of Scrutinizer, and prevents an attacker from locking a post from being edited, discovered by Mohamed A. Baset.

In addition to the security fixes, WordPress 4.2.4 contains fixes for 4 bugs:

WPDB: When checking the encoding of strings against the database, make sure we're only relying on the return value of strings that were sent to the database. #32279
Don't blindly trust the output of glob() to be an array. #33093
Shortcodes: Handle do_shortcode('<[shortcode]') edge cases. #33116
Shortcodes: Protect newlines inside of CDATA. #33106