WordPress core <= 6.2 - Cross-Site Request Forgery vulnerabilty

[viktor]

This is most likely related:

Security update

A WordPress security update (backported even to 4.1.x branch) just has been released with an added check_ajax_referer in wp-admin/includes/ajax-actions.php in function wp_ajax_set_attachment_thumbnail() starting at line 2252 /** * Ajax handler for setting the featured image for an attachment. * * @since 4.0.0 * * @see set_post_thumbnail() */ function wp_ajax_set_attachment_thumbnail() { if ( empty( $_POST['urls'] ) || ! is_array( $_POST['urls'] ) ) { wp_send_json_error(); } $thumbna…

We’re working on a new version:

WP-r55763: Embeds: Add protocol validation for WordPress Embed code.

WP-r55764: Media: Prevent CSRF setting attachment thumbnails.