WordPress Release: 5.5.14

TL;DR

WordPress 5.5.14 brings important security and functionality improvements to the core platform. This maintenance release addresses two key areas: optimizing the installation process by improving option serialization and enhancing security for ZIP archive uploads with proper verification. Additionally, it backports PHP 8 compatibility polyfills for string functions, ensuring better performance across different PHP environments.

Highlight of the Release

• Optimized option serialization during installation process
• Enhanced security for ZIP archive uploads with proper verification
• Backported PHP 8 compatibility polyfills for string functions

Migration Guide

No specific migration steps are required for this maintenance release. WordPress 5.5.14 is a backward-compatible update focused on security and bug fixes.

Site administrators should update to this version as soon as possible to benefit from the security improvements and bug fixes. The standard WordPress update process applies:

1. Back up your website before updating
2. Update through the WordPress admin dashboard or via your hosting provider's update tools
3. Test your site functionality after the update is complete

Upgrade Recommendations

This is a security and maintenance release that addresses important issues in WordPress 5.5. All WordPress sites running version 5.5.13 or earlier in the 5.5 branch should update to version 5.5.14 as soon as possible.

The update includes security improvements for ZIP archive handling and optimizations for the installation process. While these changes are focused on specific areas, they contribute to the overall security and stability of WordPress sites.

For sites on older major versions of WordPress, this release underscores the importance of staying current with the latest supported version of WordPress (currently 6.x) which includes additional security enhancements and features.

Bug Fixes

Installation Process Improvements

• Fixed option serialization during installation by implementing conditional serialization with maybe_serialize() instead of always using serialize()
• This prevents potential issues with option values being double-serialized
• Improves reliability of the WordPress installation process

ZIP Archive Handling

• Added proper verification for ZIP archives during upload
• Implemented checks to validate ZIP file integrity before processing
• Prevents potential security issues with malformed ZIP files

New Features

Backported PHP Polyfills

• Added polyfills for PHP 8 string functions str_ends_with() and str_starts_with()
• These polyfills ensure WordPress 5.5 branch maintains compatibility with newer PHP versions
• Improves developer experience by providing consistent string manipulation functions across PHP environments

Security Updates

ZIP Archive Verification

• Enhanced security for ZIP archive uploads by implementing proper verification checks
• Added validation to ensure ZIP files meet expected format requirements before processing
• Helps prevent potential security vulnerabilities related to malformed or malicious ZIP archives
• This is an important security improvement for sites that allow file uploads

Performance Improvements

Option Handling Optimization

• Improved option serialization during installation by using maybe_serialize() instead of always serializing
• This optimization prevents unnecessary serialization operations when values are already in the correct format
• Results in more efficient data handling during the WordPress installation process

Impact Summary

WordPress 5.5.14 delivers targeted improvements to core functionality with a focus on security and compatibility. The enhanced ZIP archive verification addresses potential security vulnerabilities in file upload handling, making sites more resilient against malformed or malicious archives.

The optimization of option serialization during installation improves reliability and prevents potential data corruption issues. This change ensures more consistent behavior when WordPress is being installed or updated.

The addition of polyfills for PHP 8 string functions (str_ends_with() and str_starts_with()) improves compatibility across different PHP environments, particularly for sites that may be running on newer PHP versions while using the WordPress 5.5 branch.

Overall, this maintenance release strengthens WordPress 5.5's security posture and reliability without introducing breaking changes, making it a recommended update for all sites on the 5.5 branch.