WordPress Release: 4.6.11

TL;DR

WordPress 4.6.11 Release

WordPress 4.6.11 is a security and maintenance release that addresses several important security issues and includes various bug fixes. This update focuses on improving security for login redirects, fixing HTTP host validation for localhost, optimizing metadata deletion queries, and ensuring proper escaping of version strings in templates. The release also updates the copyright year in license files.

This maintenance release is important for all WordPress 4.6.x users as it patches security vulnerabilities that could potentially be exploited.

Highlight of the Release

• Enhanced security for login redirects with wp_safe_redirect()
• Fixed HTTP host validation for localhost
• Optimized metadata deletion queries for better performance
• Improved escaping of version strings in templates
• Updated copyright year to 2018 in license files

Migration Guide

No specific migration steps are required for this update. This is a maintenance release that focuses on security and bug fixes without introducing breaking changes.

To update to WordPress 4.6.11:

1. Back up your website files and database before updating
2. Update through your WordPress dashboard or download the update from the WordPress.org website
3. If you're using a manual update method, replace the core WordPress files while preserving your wp-content directory and wp-config.php file

No changes to themes or plugins should be necessary as a result of this update.

Upgrade Recommendations

Priority: High

All users running WordPress 4.6.x are strongly encouraged to update to version 4.6.11 immediately due to the security fixes included in this release. The security improvements address potential vulnerabilities that could be exploited if left unpatched.

While WordPress 4.6.x is no longer receiving active development (current version is 5.x), this security release is important for sites that haven't yet upgraded to newer major versions.

For optimal security and features, consider upgrading to the latest WordPress major version if your site's plugins and themes are compatible.

Bug Fixes

• Login Redirect Security: Fixed an issue with login redirects when HTTPS is enforced by implementing wp_safe_redirect() for better security.

• HTTP Host Validation: Resolved a bug where localhost was incorrectly treated as the same host by default, which could potentially lead to security issues.

• Template Version String: Fixed improper escaping of version strings when used in HTML attributes, ensuring proper output sanitization.

• License Information: Updated the copyright year to 2018 in license.txt file.

New Features

No significant new features were introduced in this maintenance release. WordPress 4.6.11 focuses primarily on security enhancements and bug fixes to improve the stability and security of existing functionality.

Security Updates

• Login Redirect Protection: Implemented wp_safe_redirect() for the login page when forced to use HTTPS, preventing potential open redirect vulnerabilities.

• HTTP Host Validation: Modified how WordPress treats localhost in HTTP requests to prevent potential security issues related to host validation.

• Template Attribute Escaping: Improved the escaping of version strings when used in HTML attributes to prevent potential XSS vulnerabilities.

Performance Improvements

• Metadata Deletion Optimization: Simplified the delete all meta query in delete_metadata() function, which improves performance when deleting metadata from the database. This optimization reduces the complexity of the SQL query used for metadata deletion operations, resulting in more efficient database operations.

Impact Summary

WordPress 4.6.11 is primarily a security-focused maintenance release that addresses several important vulnerabilities and bugs. The most significant changes involve improved security for login redirects, fixed HTTP host validation for localhost, optimized metadata deletion queries, and better escaping of version strings in templates.

The security enhancements protect against potential redirect vulnerabilities and improve input validation, making sites more secure against common attack vectors. The performance optimization for metadata deletion provides a modest improvement for database operations.

This release is particularly important for sites still running WordPress 4.6.x, as it patches security issues that could potentially be exploited. While the changes are relatively minor in scope, they address important security concerns that warrant immediate updating.