WordPress Release: 4.7.27

TL;DR

WordPress 4.7.27 Security Release

This maintenance and security release addresses several important security vulnerabilities in WordPress 4.7. The update focuses on fixing permission issues with comments, restricting media shortcode access, improving REST API security, and preventing object unserialization vulnerabilities. This release is critical for all WordPress 4.7 sites to maintain security and protect user data.

Highlight of the Release

• Fixed security vulnerability in comment visibility permissions
• Restricted media shortcode AJAX functionality to specific types
• Added no-cache headers to REST API when methods are overridden
• Limited search_columns access for users without list_users capability
• Patched potential object unserialization vulnerabilities

Migration Guide

No specific migration steps are required for this security update. Simply update to WordPress 4.7.27 through your WordPress dashboard or by downloading the update from wordpress.org.

After updating, it's recommended to:

1. Review any custom code that interacts with comments to ensure it respects the new visibility restrictions
2. Check custom implementations using media shortcodes to verify they're still functioning as expected
3. Test any custom REST API implementations, especially those that override methods or use caching

Upgrade Recommendations

Immediate Upgrade Recommended

This release contains important security fixes that protect your WordPress site from potential vulnerabilities. All WordPress 4.7 sites should be updated immediately to version 4.7.27.

If you're running an older version of WordPress 4.7, this update is critical to maintain the security of your website and protect your data. The security improvements address several potential vulnerabilities that could be exploited if left unpatched.

Note that WordPress 4.7 is an older branch and no longer receives regular updates. For the best security and features, consider upgrading to the latest WordPress version.

Bug Fixes

Comment Visibility

• Fixed a vulnerability where users who couldn't see a post could still see comments on that post
• Improved permission checking to ensure comment visibility aligns with post visibility

Media Shortcodes

• Restricted media shortcode AJAX functionality to certain types to prevent potential abuse
• Added additional validation for shortcode processing

REST API Security

• Fixed issues with caching headers when REST API methods are overridden
• Ensured proper no-cache headers are sent to prevent unintended caching of sensitive data
• Limited search_columns functionality for users without the list_users capability to prevent unauthorized user data exposure

Object Unserialization

• Patched vulnerabilities related to unintended behavior when certain objects are unserialized
• Improved validation and sanitization of serialized data

New Features

No significant new features were added in this release as it primarily focuses on security improvements and bug fixes for the WordPress 4.7 branch.

Security Updates

Comment Visibility Protection

• Fixed a security issue where users without permission to view a post could still see comments on that post, potentially exposing sensitive information

Media Shortcode Restrictions

• Added security measures to restrict media shortcode AJAX functionality to certain types, preventing potential abuse vectors

REST API Security Enhancements

• Implemented proper no-cache headers when REST API methods are overridden to prevent sensitive data from being cached
• Limited search_columns functionality for users without the list_users capability, preventing unauthorized access to user data

Object Unserialization Protection

• Fixed vulnerabilities related to PHP object unserialization that could lead to unexpected behavior or potential code execution
• Improved validation of serialized data to prevent manipulation of internal objects

Performance Improvements

This release does not contain significant performance improvements as it primarily addresses security vulnerabilities and bug fixes.

Impact Summary

WordPress 4.7.27 is a security-focused maintenance release that addresses several important vulnerabilities. The update improves protection around comment visibility, restricts media shortcode functionality, enhances REST API security, and prevents object unserialization issues.

The security fixes in this release are significant as they prevent unauthorized access to comments, protect against potential REST API exploits, and close object unserialization vulnerabilities that could lead to unexpected behavior.

While this update is crucial for sites running WordPress 4.7, it's important to note that this branch is no longer receiving regular updates. Site owners should consider upgrading to the latest WordPress version for continued security updates and new features.

This release demonstrates WordPress's ongoing commitment to security, even for older branches, by backporting critical security fixes to maintain protection for sites that haven't yet upgraded to newer versions.