WordPress Release: 4.5.30

TL;DR

WordPress 4.5.30 Release

This security and privacy-focused maintenance release addresses several important vulnerabilities in WordPress 4.5. The update includes fixes for comment visibility permissions, media shortcode restrictions, REST API caching headers, and object unserialization security issues. This release is part of WordPress's ongoing commitment to maintain security across older branches, even as newer major versions are available.

Highlight of the Release

• Fixed comment visibility to respect post access permissions
• Restricted media shortcode AJAX functionality to specific types
• Improved REST API security with proper no-cache headers
• Enhanced protection against object unserialization vulnerabilities

Migration Guide

No migration steps are required for this update. This is a standard security maintenance release that can be applied directly to any WordPress 4.5.x installation.

To update:

1. Back up your website files and database
2. Update through the WordPress dashboard or download the update and install manually
3. No additional configuration changes are needed after updating

Upgrade Recommendations

Immediate Upgrade Recommended

This release contains important security fixes that protect your WordPress site from potential vulnerabilities. All users running WordPress 4.5.x should update to version 4.5.30 immediately.

While WordPress 4.5 is no longer receiving active feature development, the security team continues to backport critical security fixes to maintain older installations. However, for the best security, performance, and features, users are strongly encouraged to upgrade to the latest major WordPress version.

If you're still running WordPress 4.5.x, consider planning a full upgrade to the current major release as soon as feasible for your site.

Bug Fixes

Comment Visibility

• Fixed an issue where users without permission to view a post could still see comments on that post
• Implemented proper permission checking for comment visibility

Media Shortcodes

• Restricted media shortcode AJAX functionality to certain types to prevent potential security issues
• Added type validation to prevent unauthorized access

REST API

• Fixed caching behavior by ensuring no-cache headers are properly sent when methods are overridden
• Improved API security through proper header management

Object Unserialization

• Patched potential vulnerabilities related to object unserialization
• Implemented additional validation to prevent unintended behavior when certain objects are unserialized

New Features

No new features were introduced in this maintenance release. WordPress 4.5.30 focuses exclusively on security enhancements and bug fixes for the 4.5 branch.

Security Updates

Enhanced Security Measures

This release includes several important security fixes:

• Comment Privacy Protection: Fixed a vulnerability that could allow users to see comments on posts they don't have permission to view, protecting sensitive information
• Media Shortcode Restrictions: Added type restrictions to media shortcode AJAX functionality to prevent potential security exploits
• REST API Header Security: Ensured proper no-cache headers are sent when REST API methods are overridden, preventing potential cache-based attacks
• Object Unserialization Protection: Implemented safeguards against unintended behavior when certain objects are unserialized, addressing potential object injection vulnerabilities

These security fixes help protect WordPress sites from potential exploits and unauthorized access to content.

Performance Improvements

This release does not contain specific performance improvements. The focus was primarily on security enhancements and bug fixes rather than performance optimizations.

Impact Summary

WordPress 4.5.30 is a security-focused maintenance release that addresses several important vulnerabilities. The update improves comment privacy by ensuring users cannot see comments on posts they don't have permission to view. It also enhances security around media shortcodes, REST API caching, and object unserialization.

This release is particularly important for sites that handle sensitive information or have restricted content, as it prevents potential information disclosure through comments. The fixes for REST API headers and object unserialization help protect against more technical exploits that could affect site security.

While this update maintains the security of WordPress 4.5.x installations, users should note that this branch is in long-term security maintenance mode only. For the full benefits of WordPress's evolution, including performance improvements and new features, upgrading to the latest major version is recommended.