WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress 7.1.1 patches 11 core vulnerabilities, including stored XSS in wpautop() and an authenticated path traversal in the REST Templates Controller reported by Anthropic.
WordPress released 7.1.1, a short-cycle maintenance and security update fixing 11 vulnerabilities across core, themes, REST API, comments, XML-RPC, and plugin management, plus 17 core and 19 Block Editor bug fixes. The most notable flaw is a stored XSS in wpautop() where unauthenticated commenters can inject script that executes when a moderator approves the comment, potentially enabling admin session theft. Anthropic reported an authenticated path traversal in the WP REST Templates Controller and an authorization flaw letting low-privileged users overwrite posts outside their scope. Security fixes are backported to supported branches through WordPress 4.7, and WordPress 7.2 is expected in December.
- Stored XSS in wpautop() lets unauthenticated commenters inject script that executes when moderators approve comments.
- Authenticated path traversal in WP REST Templates Controller and a post-overwrite authorization flaw were reported by Anthropic.
- Other fixes cover XML-RPC customize_changeset publishing bypass, private post title disclosure, and comment reparenting by any authenticated user.
- Security fixes are backported to supported branches through WordPress 4.7; automatic updates apply the patch.
From the original article
3 min read at gbhackers.com
WordPress has released version 7. 1. 1, a maintenance and security update that addresses 11 vulnerabilities affecting core platform components, themes, REST API functionality, comments, XML-RPC, and plugin management.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.