WordPress Releases Critical Security Update

LOS ANGELES — Less than a week after the release of WordPress Version 4.2, a critical security update was released today — along with an admonition for all users to immediately update their installations.

Debuting on April 23, with a goal of improving WordPress’ communication, sharing and simplicity, Version 4.2, nicknamed “Powell” in honor of jazz pianist Bud Powell, offers easier ways to share content, while providing extended character support, enhanced embed options, and streamlined plugin updates.

Now, an emergency patch, Version 4.2.1, has been released to the public and is an update for all previous WordPress versions. The patch addresses a cross-site scripting vulnerability that could enable comment posters to compromise a site.

As for who is affected by this vulnerability, all WordPress-powered sites are at risk if they allow users to post comments via the integrated commenting system.

“An attacker could leverage a bug in the way comments are stored in the site’s database to insert malicious scripts on your site, thus potentially allowing them to infect your visitors with malware, inject SEO spam or even insert backdoor in the site’s code if the code runs when in a logged-in administrator browser,” Marc-Alexandre Montpas wrote for Sucuri.net, advising WordPress site admins to “definitely disable comments on your site until a patch is [installed] to protect your site and customers.”

The unexpected update fuels critics that claim the Open Source WordPress core lacks security, but the opposite is true: As the world’s most popular publishing platform, WordPress is actively embraced by tens of thousands of developers and used in countless websites, making its underlying code perhaps the most scrutinized software on the planet. This means that vulnerabilities are revealed and mitigated far more often than those contained in proprietary systems that are only well-known to a relative handful of developers and users.

WordPress 4.2.1 is now rolling out as an automatic update for sites that support them.

To manually update an installation, download WordPress 4.2.1 or click “Update Now” from the admin Dashboard. 

Related:  

Copyright © 2025 Adnet Media. All Rights Reserved. XBIZ is a trademark of Adnet Media.
Reproduction in whole or in part in any form or medium without express written permission is prohibited.

More News

France Reinstates Age Verification Rule for EU Sites

France’s highest court, the Council of State, on Tuesday reinstated age verification rules for EU-based sites under the country’s Security and Regulation of the Digital Space (SREN) law, ruling in favor of the French government and against Hammy Media.

Whisper Fans Joins Pineapple Support as Supporter-Level Sponsor

Whisper Fans has joined the ranks of over 70 adult businesses and organizations committing funds and resources to Pineapple Support.

Utherverse Launches 'Red Light Center' Virtual World

Virtual reality and metaverse technology company Utherverse has launched its new virtual world, RedLightCenter.io.

European Commission Approves AV Guidelines, Unveils Prototype App

The European Commission on Monday released its final, approved guidelines for protecting minors online under the EU’s Digital Services Act (DSA) and made public a “white label” age verification app intended to help sites and platforms comply with age verification rules under the DSA.

New Membership Site 'Sluts Corner' Launches

R18 Entertainment has launched a new membership site, SlutsCorner.com.

Roxie Rae Relaunches Site Through XSiteAbility

Roxie Rae has relaunched her site through XSiteAbility.

Federal Appeals Court Vacates FTC 'Click to Cancel' Rule Pending Review

The U.S. Court of Appeals for the 8th Circuit on Tuesday vacated the Federal Trade Commission’s “click-to-cancel” rule aimed at making it easier for consumers to cancel online subscriptions, pending further review.

FSC Drops Florida AV Lawsuit in Wake of SCOTUS Decision

A U.S. district court judge granted on Tuesday a motion by Free Speech Coalition to dismiss the trade association’s lawsuit over Florida’s age verification law, a case that had been on hold pending the Supreme Court’s recent ruling on the constitutionality of state AV laws.

Show More