{"id":6091,"date":"2018-07-05T17:00:25","date_gmt":"2018-07-05T17:00:25","guid":{"rendered":"https:\/\/wordpress.org\/news\/?p=6091"},"modified":"2022-11-18T22:53:13","modified_gmt":"2022-11-18T22:53:13","slug":"wordpress-4-9-7-security-and-maintenance-release","status":"publish","type":"post","link":"https:\/\/wordpress.org\/news\/2018\/07\/wordpress-4-9-7-security-and-maintenance-release\/","title":{"rendered":"WordPress 4.9.7 Security and Maintenance Release"},"content":{"rendered":"\n<p>WordPress 4.9.7 is now available. This is a <strong>security and maintenance release<\/strong> for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.<\/p>\n\n\n\n<p>WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory.<\/p>\n\n\n\n<p>Thank you to <a href=\"https:\/\/hackerone.com\/slavco\">Slavco<\/a> for reporting the original issue and <a href=\"https:\/\/www.wordfence.com\/\">Matt Barry<\/a> for reporting related issues.<\/p>\n\n\n\n<p>Seventeen other bugs were fixed in WordPress 4.9.7. Particularly of note were:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\t<li>Taxonomy: Improve cache handling for term queries.<\/li>\n\t<li>Posts, Post Types: Clear post password cookie when logging out.<\/li>\n\t<li>Widgets: Allow basic HTML tags in sidebar descriptions on Widgets admin screen.<\/li>\n\t<li>Community Events Dashboard: Always show the nearest WordCamp if one is coming up, even if there are multiple Meetups happening first.<\/li>\n\t<li>Privacy: Make sure default privacy policy content does not cause a fatal error when flushing rewrite rules outside of the admin context.<\/li>\n<\/ul>\n\n\n\n<p><a href=\"https:\/\/wordpress.org\/download\/\">Download WordPress 4.9.7<\/a> or venture over to Dashboard \u2192 Updates and click &#8220;Update Now.&#8221; Sites that support automatic background updates are already beginning to update automatically.<\/p>\n\n\n\n<p>The previously scheduled 4.9.7 is now referred to as 4.9.8, and will follow the <a href=\"https:\/\/make.wordpress.org\/core\/2018\/07\/04\/dev-chat-summary-july-4th-4-9-7-week-7\/\">release schedule posted yesterday<\/a>.<\/p>\n\n\n\n<p>Thank you to everyone who contributed to WordPress 4.9.7:<\/p>\n\n\n\n<p><a href=\"https:\/\/profiles.wordpress.org\/1naveengiri\/\">1naveengiri<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jorbin\/\">Aaron Jorbin<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/abdullahramzan\/\">abdullahramzan<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/alejandroxlopez\/\">alejandroxlopez<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/azaozz\/\">Andrew Ozz<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/aryamaaru\/\">Arun<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/birgire\/\">Birgir Erlendsson (birgire)<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/bjornw\/\">BjornW<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/boonebgorges\/\">Boone Gorges<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/kraftbj\/\">Brandon Kraft<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/chetan200891\/\">Chetan Prajapati<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/dlh\/\">David Herrera<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/flixos90\/\">Felix Arntz<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/garetharnold\/\">Gareth<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/iandunn\/\">Ian Dunn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/ianbelanger\/\">ibelanger<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/johnbillion\/\">John Blackbourn<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/desrosj\/\">Jonathan Desrosiers<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/joyously\/\">Joy<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/khaihong\/\">khaihong<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/lbenicio\/\">lbenicio<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/leanderiversen\/\">Leander Iversen<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/mermel\/\">mermel<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/metalandcoffee\/\">metalandcoffee<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/jbpaul17\/\">Migrated to @jeffpaul<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/palmiak\/\">palmiak<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/sergeybiryukov\/\">Sergey Biryukov<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/skoldin\/\">skoldin<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/subrataemfluence\/\">Subrata Sarkar<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/itowhid06\/\">Towhidul Islam<\/a>, <a href=\"https:\/\/profiles.wordpress.org\/warmlaundry\/\">warmlaundry<\/a>, and <a href=\"https:\/\/profiles.wordpress.org\/yuriv\/\">YuriV<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress 4.9.7 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately. WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads [&hellip;]<\/p>\n","protected":false},"author":140668,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"episode_type":"","audio_file":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","date_recorded":"","explicit":"","block":"","filesize_raw":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[14,15],"tags":[437],"class_list":["post-6091","post","type-post","status-publish","format-standard","hentry","category-releases","category-security","tag-minor-releases"],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pZhYe-1Af","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/6091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/users\/140668"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/comments?post=6091"}],"version-history":[{"count":22,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/6091\/revisions"}],"predecessor-version":[{"id":6117,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/posts\/6091\/revisions\/6117"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/media?parent=6091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/categories?post=6091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wordpress.org\/news\/wp-json\/wp\/v2\/tags?post=6091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}