WordPress Core version 4.8.2 has just been released. This is a minor update and a security release which means that your sites will update automatically within the next 24 hours unless you have disabled auto updates.

The update includes a fix to $wpdb->prepare() to help protect against SQLi injection attacks. WordPress core is not vulnerable to SQLi injection attacks directly, but certain plugins and themes may be vulnerable depending on how they use the $wpdb->prepare() function in their code. This fix alone is reason to update immediately to 4.8.2.

The release fixes five cross site scripting vulnerabilities. These are in:

oEmbed discovery
The visual editor
The plugin editor
In template names

Two path traversal vulnerabilities were fixed. These are:

In the file unzipping code
In the customizer

An open redirect was also fixed on the user and term editing screens. 4.8.2 also includes 6 maintenance fixes.

Now that the existence of these vulnerabilities is public, it becomes much more likely that they will be exploited. It is very important that you update as soon as possible to 4.8.2.

To update manually now you can sign into your WordPress site, mouse over the Dashboard on the top left and click ‘Updates’ and complete the update process.

Please share this information with the rest of the community to ensure everyone updates in a timely fashion. Thanks.

Resources:

You can find the full announcement here.
The release notes are here.
The list of changes are on this page.
You can download WordPress 4.8.2 on this page.

Are you having challenges with your Wordpress Installations? Get in touch with ASSURE Educational Services - 07063397940, 08050701465, admin@assure.ng for a quick fix.

Did you enjoy this post? Share it!

https://news.assure.ng/wordpress-security-update-4-8-2-update-immediately/

Good.

Nice development