WordPress released version 7.1.3 globally today, addressing seven security vulnerabilities and four bug fixes, including a critical flaw that affected image uploads for some users.
The update resolves issues such as a stored cross-site scripting (XSS) vulnerability, a denial-of-service (DoS) problem, and a second-order SQL injection, according to a statement from WordPress.
Among the four bug fixes, a critical flaw prevented image uploads on hosting environments that lacked the PHP DOM extension. This specific issue was introduced in WordPress 7.0.
The critical image upload problem stemmed from the software’s use of the DOMDocument function without prior verification of the extension’s presence, WordPress reported.
WordPress recommended that all site administrators update their installations immediately to version 7.1.3. The organization also confirmed that it is backporting security fixes to older branches, including WordPress 4.7, to ensure broader protection.
The image upload bug is considered rare, having taken 134 days from the release of WordPress 7.0 for the first report to surface. This suggests that the majority of web hosts already have the necessary PHP DOM extension installed.
Source: Search Engine Journal
