WordPress 6.9.4 quietly fixes what earlier security updates left exposed

WordPress has released security update 6.9.4 for WordPress core, following earlier security releases 6.9.2 and 6.9.3. The new version applies additional security fixes that the WordPress Security Team determined were not fully implemented in the previous updates.

Key details

WordPress 6.9.2 was released as a security update to address ten vulnerabilities in WordPress core and bundled components. After deployment, some sites experienced front end failures when loading pages.

• WordPress 6.9.2 patched ten security issues in core and an external PHP library.
• Some sites displayed blank front end pages after updating to 6.9.2, although the admin dashboard remained accessible.
• Affected sites commonly used themes that loaded template files in a non-standard way.
• WordPress released 6.9.3 as a bugfix to restore functionality for those themes.
• The WordPress Security Team later determined that not all security fixes in 6.9.2 and 6.9.3 were fully applied.
• Version 6.9.4 was released to include the remaining security fixes identified by the team.

WordPress classifies 6.9.4 as a security release that completes the protections introduced in 6.9.2 and 6.9.3.

Background context

Reports in the official WordPress support forums described sites that updated to 6.9.2 and then showed blank front end pages, while administrators could still log in and view page content in the editor. An early support post documented the issue and its impact on affected sites.

In community discussions, site owners also speculated that the 6.9.2 security release was linked to sudden front end failures on some installations.

According to the release notes for WordPress 6.9.3, the bug primarily affected "some themes that use an unusual 'stringable object' mechanism when loading template file paths."

This approach was not officially supported, since the template_include filter is designed to accept a string.

The team shipped 6.9.3 as a fast follow release to prevent those sites from remaining broken.

WordPress.org also published a list of the ten security issues targeted in the 6.9.2 line of releases. These include vulnerabilities in the HTML API, navigation menus, AJAX endpoints, the Notes feature, and the bundled PclZip and getID3 components. Version 6.9.4 followed after the team confirmed that some of these fixes required additional changes.

Vulnerabilities addressed in WordPress core

WordPress reports that the 6.9.2 through 6.9.4 security releases address the following ten issues:

• Blind server side request forgery (SSRF) issue.
• Proof of concept chain weakness in the HTML API and Block Registry.
• Regular expression denial of service in numeric character references.
• Stored cross site scripting in navigation menus.
• AJAX query-attachments authorization bypass.
• Stored cross site scripting via the data-wp-bind directive.
• Cross site scripting that allows overriding client side templates in the admin area.
• PclZip path traversal issue.
• Authorization bypass on the Notes feature.
• XML External Entity (XXE) in the external getID3 library.

Security firm Wordfence has published technical details for four of these issues, rating them medium severity with CVSS scores from 4.3 to 6.5. According to the Wordfence analysis, all four require an authenticated user account, ranging from Subscriber to Administrator level depending on the specific vulnerability.

Source citations

• WordPress 6.9.3 release notes, including the template loading bugfix.
• Wordfence advisory for the XXE vulnerability in the bundled getID3 library.