WordPress 5.8.3 Security Release fixes four vulnerabilities

WordPress maintainers have released WordPress 5.8.3 that addresses four vulnerabilities and recommend admins to update their sites immediately

The WordPress 5.8.3 security release addresses four vulnerabilities affecting versions between 3.7 and 5.8, it is labeled as a short-cycle security release. The organization announced that the next major release will be version 5.9, which is already in the Release Candidate stage.

Two of the vulnerabilities addressed with this release are SQL injection issues; a first vulnerability resides in the WP_Query and was reported by ngocnb and khuyenn from GiaoHangTietKiem JSC through Trend Micro Zero Day Initiative; the second vulnerability affects WP_Meta_Query and was discovered by Ben Bidner of the WordPress security team, it is only relevant to versions 4.1-5.8.

The third vulnerability is a stored XSS through post slugs that was discovered by Karim El Ouerghemmi and Simon Scannell from SonarSource.

The fourth vulnerability is an object injection in some multisite installations that was reported by Simon Scannell of SonarSource.

All of the above vulnerabilities were privately reported to WordPress giving the security team time to address them before they could be exploited to compromise WordPress sites.

Users can update to WordPress 5.8.3 by downloading from WordPress.org or visiting your Dashboard → Updates and clicking Update Now.

WordPress websites are a privileged target for threat actors, recently Wordfence researchers spotted a massive wave of attacks that was targeting over 1.6 million WordPress sites from 16,000 IPs.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, WordPress 5.8.3)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.