WordPress Release: 4.9.24

TL;DR

WordPress 4.9.24 is a security and maintenance release that addresses several important vulnerabilities. This update focuses on preventing unauthorized access to comments, restricting media shortcode functionality, improving REST API security, and fixing object unserialization issues. The release is part of WordPress's ongoing commitment to maintaining security for older branches while users transition to newer versions.

Highlight of the Release

• Fixed comment visibility to prevent unauthorized users from seeing comments on posts they cannot access
• Restricted media shortcode AJAX functionality to specific types for improved security
• Enhanced REST API security with proper no-cache headers and limited search capabilities
• Patched potential object unserialization vulnerabilities

Migration Guide

No specific migration steps are required for this update. This is a standard security release that can be applied through the WordPress dashboard or via manual update.

As always, it's recommended to:

1. Back up your website before updating
2. Test the update in a staging environment if possible
3. Update all sites running WordPress 4.9.x to this latest version

Note that WordPress 4.9 is an older branch, and users are encouraged to upgrade to the latest major version of WordPress when possible for the most comprehensive security and feature improvements.

Upgrade Recommendations

Immediate Upgrade Recommended

This release contains important security fixes that protect your WordPress site from potential vulnerabilities. All users running WordPress 4.9.x should update to version 4.9.24 immediately.

While WordPress 4.9 continues to receive security updates, users are strongly encouraged to consider upgrading to the latest major version of WordPress for access to improved security features, performance enhancements, and new functionality.

This update can be applied through your WordPress dashboard or by downloading the update from WordPress.org.

Bug Fixes

Comment Visibility

• Fixed an issue where users who couldn't see a post could still see comments on that post, creating a potential information disclosure vulnerability

Media Shortcodes

• Restricted media shortcode AJAX functionality to certain types to prevent potential security issues

REST API

• Fixed issues with cache headers when REST API methods are overridden
• Limited search_columns for users without proper list_users capabilities to prevent unauthorized data access

Object Unserialization

• Patched vulnerabilities related to unintended behavior when certain objects are unserialized

New Features

No new features were introduced in this release. WordPress 4.9.24 is focused on security improvements and bug fixes for the 4.9 branch.

Security Updates

Comment Privacy Enhancement

• Prevents unauthorized users from viewing comments on posts they don't have permission to see, closing a potential information disclosure vulnerability

Media Shortcode Restrictions

• Adds type restrictions to media shortcode AJAX functionality to prevent potential security exploits

REST API Security Improvements

• Ensures proper no-cache headers are sent when REST API methods are overridden, preventing potential cache-based attacks
• Restricts search_columns functionality for users without the list_users capability, preventing unauthorized access to user data

Object Unserialization Protection

• Fixes vulnerabilities that could allow unintended behavior when certain objects are unserialized, which could potentially be exploited

Performance Improvements

This release does not contain specific performance improvements. The changes are primarily focused on security enhancements and bug fixes.

Impact Summary

WordPress 4.9.24 is a critical security release that addresses several important vulnerabilities that could potentially be exploited to access unauthorized information or compromise site security.

The fixes for comment visibility prevent information leakage through comments on private posts. The media shortcode restrictions and REST API improvements help prevent potential attack vectors. The object unserialization fixes address vulnerabilities that could lead to unexpected behavior or security issues.

This release is particularly important for sites that:

• Use private or password-protected content
• Rely heavily on the REST API
• Have custom code that interacts with WordPress comments or media

While this update doesn't introduce new features or performance improvements, it significantly enhances the security posture of WordPress 4.9.x installations and should be applied immediately to all sites running this branch.