WordPress 7.0.3 was released today (a couple of hours ago). This is an important security release containing fixes for 12 vulnerabilities, so site owners are strongly advised to update immediately.
The most serious issues include a pre-auth reflected XSS vulnerability on the login screen that could potentially lead to PHP code execution, an SSRF vulnerability allowing requests to link-local addresses, and a multisite privilege-escalation issue affecting networks with user registration enabled.
The release also fixes several stored XSS vulnerabilities available to Contributor or Author-level users, a CSS injection issue, an email-confirmation bypass, post slug enumeration, and multiple cases where protected information could be exposed through blocks or comment feeds.
Security fixes were also backported to older WordPress branches. WordPress 6.9 received version 6.9.6, while affected versions down to WordPress 4.7 received their own security updates. WordPress 4.6 and earlier no longer receive security fixes.
You can update directly from Dashboard → Updates or download the latest release from WordPress.org.
After updating, clear your site and server caches and quickly verify the login screen, editor, Quick Edit, and multisite registration if those features are in use. No WordPress packages were revised in this release.
If you manage client websites or have automatic core updates disabled, now is a good time to check every installation manually.
Changelog
I was trying to update today but I am stuck at version 7.0, the automatic updated is saying that there is no new version. What I am missing?
I also had exactly the same issue in the past.
I am sorry to say this, but I think you are hacked. Check mu-plugins, if you have the any plugin which you don’t recognize… In my case, it was a mu-plugin placed there which blocked wp updates.
Also, check any admin users which you did not create, reset all your passwords of your own admin users and click log out all users for your account, check plugins which you don’t recognize, update old plugins, check uploads dir for any php file which should not be there, check any suspect cron jobs, authorized_keys, .user.ini or php.ini for auto_prepend_file, .htaccess, wp-config.php, and WordPress drop-in files such as object-cache.php, advanced-cache.php and db.php.
Run wp core verify-checksums and wp plugin verify-checksums
I also had to regenerate the WordPress salts.
After you find the script which is blocking updates, if you remove it and you do an update for wp, you should automatically clean any code which was added to your current wp install also.
However, in some cases, if the attacker obtained server/root access, the safest solution is to rebuild the server and restore only verified clean content…
If you are lucky, this is just some kind of server side issue, which does not allow wp to write to the disk, maybe your server storage disk is full, check also on this.
Let me know how this unfolded and if you found anything.
1 Like
Hmm.
I know that I’ve done a few things to block some updates… I need to see what is going on, as for hacked I don’t think so but who knows, I did not noticed any wired or bad actions on my side but anythign is possible but most likely is something that I added probably in the theme, I will look into it!
1 Like
The only way to update to 7.03 for me was to uninstall and delte wordpress completely and install it again… a nightmare!
I still suspect you were hacked…
1 Like
Probably, I did not noticed anything suspicious… either way I sarted wiht a fresh install now is all good!
Looking at the WordPress enviroment how compelx and cool it evolved, I don’t see this going away any time soon, is just too good, it has its issues but overall is amazing, nothing like it!
1 Like
WordPress 7.0.4 has now been released with another important security fix. It addresses an authenticated Author+ remote code execution vulnerability affecting sites that use Imagick and Ghostscript. Please see the new announcement here: WordPress 7.0.4 Released... Yes, Another Security Update. Update Now
1 Like