WordPress 5.0 users are being urged to u pdate Vulnerability-related.PatchVulnerability their CMS software to f ix Vulnerability-related.PatchVulnerability a number of serious bugs . The update ( WordPress 5.0.1 ) a ddresses Vulnerability-related.PatchVulnerability seven flaws and w as issued Vulnerability-related.PatchVulnerability Thursday , less than a week after WordPress 5.0 w as released. Vulnerability-related.PatchVulnerability The most serious of the flaws is a bug that allows the WordPress “ user activation screen ” to be indexed by Google and other search engines , leading to the possible public exposure of WordPress usernames and passwords . “ The user activation screen could be indexed by search engines in some uncommon configurations , leading to exposure of email addresses , and in some rare cases , default generated passwords , ” wrote security firm Wordfence in a blog post outlining the flaws . Wordfence s aid Vulnerability-related.DiscoverVulnerability all WordPress users running versions of the 4.x branch of WordPress core a re also impacted Vulnerability-related.DiscoverVulnerability by similar issues . It urges those 4.x users , not ready to update to the 5.0 branch , to i nstall Vulnerability-related.PatchVulnerability the WordPress 4.9.9 security update ( also r eleased Vulnerability-related.PatchVulnerability this week ) , which a ddresses Vulnerability-related.PatchVulnerability similar bugs . Three of the bugs f ixed Vulnerability-related.PatchVulnerability with the release of WordPress 5.0.1 are cross-site scripting ( XSS ) vulnerabilities . Two of the XSS bugs could allow for an adversary to launch a privilege escalation attack . “ Contributors could edit new [ WordPress web-based ] comments from higher-privileged users , potentially leading to a cross-site scripting vulnerability , ” Wordfence wrote . “ This is another vulnerability that requires a higher-level user role , making the likelihood of widespread exploitation quite low . WordPress a ddressed Vulnerability-related.PatchVulnerability this issue by removing the < form > tag from their HTML whitelist. ” WordPress plugins a re potentially impacted Vulnerability-related.DiscoverVulnerability by a third XSS bug that opens up sites to attacks launched by adversaries who send specially crafted URLs to affected sites . According to researchers , the bug d oesn’t impact Vulnerability-related.DiscoverVulnerability WordPress 5.0 directly , rather the “ wpmu_admin_do_redirect ” function used by some WordPress plugins . “ Specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances , ” they said . A PHP ( Hypertext Preprocessor ) bug w as also identified Vulnerability-related.DiscoverVulnerability by WordPress . This bug is more technical in nature and w as found Vulnerability-related.DiscoverVulnerability by Sam Thomas , of Secarma Labs , who p ublicly disclosed Vulnerability-related.DiscoverVulnerability it at the 2018 Black Hat conference . “ This vulnerability allows an author to assign an arbitrary file path to an attachment . The file path supplied by the author uses the phar : // stream wrapper on a previously uploaded attachment which leads to object injection utilizing a “ feature ” of the PHAR file type which stores serialized objects in the metadata of the PHAR file , ” wrote Wordfence . WordPress is also warning users of a unauthorized file deletion bug and an unauthorized post creation bug .

WordPress 5.0 users are being urged to u pdate Vulnerability-related.PatchVulnerability their CMS software to f ix Vulnerability-related.PatchVulnerability a number of serious bugs . The update ( WordPress 5.0.1 ) a ddresses Vulnerability-related.PatchVulnerability seven flaws and w as issued Vulnerability-related.PatchVulnerability Thursday , less than a week after WordPress 5.0 w as released. Vulnerability-related.PatchVulnerability The most serious of the flaws is a bug that allows the WordPress “ user activation screen ” to be indexed by Google and other search engines , leading to the possible public exposure of WordPress usernames and passwords . “ The user activation screen could be indexed by search engines in some uncommon configurations , leading to exposure of email addresses , and in some rare cases , default generated passwords , ” wrote security firm Wordfence in a blog post outlining the flaws . Wordfence s aid Vulnerability-related.DiscoverVulnerability all WordPress users running versions of the 4.x branch of WordPress core a re also impacted Vulnerability-related.DiscoverVulnerability by similar issues . It urges those 4.x users , not ready to update to the 5.0 branch , to i nstall Vulnerability-related.PatchVulnerability the WordPress 4.9.9 security update ( also r eleased Vulnerability-related.PatchVulnerability this week ) , which a ddresses Vulnerability-related.PatchVulnerability similar bugs . Three of the bugs f ixed Vulnerability-related.PatchVulnerability with the release of WordPress 5.0.1 are cross-site scripting ( XSS ) vulnerabilities . Two of the XSS bugs could allow for an adversary to launch a privilege escalation attack . “ Contributors could edit new [ WordPress web-based ] comments from higher-privileged users , potentially leading to a cross-site scripting vulnerability , ” Wordfence wrote . “ This is another vulnerability that requires a higher-level user role , making the likelihood of widespread exploitation quite low . WordPress a ddressed Vulnerability-related.PatchVulnerability this issue by removing the < form > tag from their HTML whitelist. ” WordPress plugins a re potentially impacted Vulnerability-related.DiscoverVulnerability by a third XSS bug that opens up sites to attacks launched by adversaries who send specially crafted URLs to affected sites . According to researchers , the bug d oesn’t impact Vulnerability-related.DiscoverVulnerability WordPress 5.0 directly , rather the “ wpmu_admin_do_redirect ” function used by some WordPress plugins . “ Specially crafted URL inputs could lead to a cross-site scripting vulnerability in some circumstances , ” they said . A PHP ( Hypertext Preprocessor ) bug w as also identified Vulnerability-related.DiscoverVulnerability by WordPress . This bug is more technical in nature and w as found Vulnerability-related.DiscoverVulnerability by Sam Thomas , of Secarma Labs , who p ublicly disclosed Vulnerability-related.DiscoverVulnerability it at the 2018 Black Hat conference . “ This vulnerability allows an author to assign an arbitrary file path to an attachment . The file path supplied by the author uses the phar : // stream wrapper on a previously uploaded attachment which leads to object injection utilizing a “ feature ” of the PHAR file type which stores serialized objects in the metadata of the PHAR file , ” wrote Wordfence . WordPress is also warning users of a unauthorized file deletion bug and an unauthorized post creation bug .