Skip to content

v4.0.1 - Security fixes

Choose a tag to compare

View all tags
@benbalter benbalter released this 30 Apr 03:16
· 16 commits to master since this release
v4.0.1
56899e0
This commit was signed with the committer’s verified signature.
benbalter Ben Balter
SSH Key Fingerprint: gONqqkmImmc/NLcd/Hgh+t9JFMv7/Ca9mwZQlm0MR9U
Verified
Learn about vigilant mode.

Security fixes

This is a security patch release. All fixes are post-auth (require manage_options) but recommended for all installations, especially shared hosting and multisite.

  • Predictable temp directory (Medium, CWE-330/377): Replaced md5(time()) with wp_generate_password() for the export temp directory name to prevent symlink/TOCTOU attacks on shared hosts.
  • Web-accessible WP bootstrap (Low, CWE-665): Deprecated jekyll-export-cli.php now rejects non-CLI access before loading wp-load.php.
  • Path sanitization (Low, CWE-22): Each path segment of page filenames is now individually sanitized as defense-in-depth against path traversal.
  • Multisite cache correctness (Low, CWE-665): copy_recursive() symlink-allow-list cache is now keyed by blog ID.

Full Changelog: v4.0.0...v4.0.1

Assets 2
Loading