WordPress 3.0.5 addresses security vulnerabilities

The WordPress.org development team has released version 3.0.5 of its open source blogging and publishing platform, a maintenance and security update that addresses two vulnerabilities; these could have allowed a Contributor- or Author-level user to gain further access to the site. An information disclosure issue has also been fixed that allowed Author-level users to view the contents of posts which they should not be able to see, such as draft and private posts.

WordPress 3.0.5 features the addition of two new security enhancements, the first of which improves the security of plugins which were not properly utilising the platform's security API. The other provides better defence against a vulnerability that was fixed in the previous version. All users are encouraged to upgrade to the latest release as soon as possible.

Additionally, the developers have released a fourth release candidate for version 3.1 of WordPress (direct download). WordPress 3.1 RC4 includes all of the enhancements and security fixes noted above, as well as fixes for approximately two dozen bugs.

Existing users can install the latest development version via the WordPress Beta Tester Plugin and setting it to "bleeding edge nightlies". Any bugs or issues found during testing can be reported in the forums, mailing lists, over IRC on irc.freenode.net #wordpress-dev or directly into the WordPress Trac.

Further information about the 3.0.5 and 3.1 RC4 releases can be found in a post on the WordPress blog. WordPress 3.0.5 is now available in the WordPress dashboard or can be downloaded from the project's web site. WordPress is released under the GNU General Public License (GPL).

See also:

• WordPress for Android adds QuickPress shortcuts, a report from The H.

(crve)