ClassicPress 2.7.3 Release Notes

Announcements Release Notes
1

We’re happy to announce the release of ClassicPress 2.7.3.

This is a security release.

Security Fixes

  • Posts, Post Types: Reject a supplied post ID on the create path in _wp_translate_postdata().
  • Comments: Enforce target post permissions when updating notes via REST.
  • XML-RPC: Reject writes to internal-only builtin post types.
  • Administration: Add authorization check to wp_ajax_sample_permalink().
  • Customize: Improve header_image_data theme mod sanitization.
  • Media: Check read_post on the attachment’s parent post.
  • Plugins: Require network plugin authority to Ajax-activate a network-only plugin.
  • Formatting: Prevent wpautop() moving a paragraph into an attribute of a blockquote.
  • Themes: Restrict path traversal in locate_template().
  • Harden unserialize() call in Widget Customizer

Contributors

In no particular order the following people have contributed to this ClassicPress release:

ClassicPress props

Matt Robinson, Simone Fioravanti, Tim Kaye, Ikram-4.

ClassicPress committers (in random order)

Matt Robinson.

WordPress props

xknown, westonruter, jorbin, vortfu, batmoo, davidbinda, jeremyfelt, ramonopoly, jonsurrell, adamsilverstein, villanovachile, johnbillion, peterwilsoncc, lancewillett, dmsnell, whyisjake, buffer1024, joehoyle, rafiem, marcs0h, fiocavallari, sirlouen, joemcgill, pypwalters, swissspidy, shailu25, oglekler, mukesh27, audrasjb, wildworks, rajinsharwar, martinkrcho, jeffpaul, ressl.

Download this release

New sites Download
ClassicPress-release-2.7.3.zip
and follow the installation instructions.
Existing WordPress sites Download the migration plugin and follow the migration instructions.
Existing ClassicPress sites Use the built-in update mechanism (more info).

Full changelog

The full changelog is available on GitHub.

2 Likes