0

I checked a Wordpress instances with https://hackertarget.com/wordpress-security-scan/ and it told me that the Wordpress version is 4.7.9 and that I should update. True, current version is 4.9.2, but according to this page:

https://codex.wordpress.org/WordPress_Versions

all branches from 3.7. on have recently been updated (January 16th). So, doesn't that mean that all these versions should be as secure as the newest 4.9.2 ?

I would like to have good arguments convincing webmasters to upgrade their wordpress. I personally would always care for to install the very newest version, but I would like to know what is the actual thread to point it out to lazy webmasters.

For example, what could I tell the webmaster who is still running the 4.7.9 version, what security issues his instance contains, are there any known? Or just potential issues because its so very well supported like the newest version?

  • 1
    Please read the blog attached to version 4.7.9 from the page you linked: wordpress.org/news/2018/01/… as well as the note on the release notes of 4.7.9 "From the WordPress 4.9.2 release post: WordPress versions 4.9 and earlier are affected by an XSS vulnerability ..." – schroeder Jan 19 '18 at 21:40
  • yes "This is a security and maintenance release for all versions since WordPress 3.7" so as far as I understand, they fixed all these versions (3.7, 3.8, ..., 4.8, 4.9) for this security issue, did they not? – Jekoula Jan 19 '18 at 21:44
  • No ... please read the full line ... The antecedent to "this" is the version 4.9.2 ... "WordPress 4.9.2 is now available. This is a security and maintenance release..." You need to update to 4.9.2 to get the security fix ... – schroeder Jan 19 '18 at 21:46
  • Of course i read the full lin (please don't spoof me..), but as you can see in the changelog list, as I already pointed out, there is for example a version 3.7.25 that has also been updated at the same time as 4.9.2. So I guess that means, it has also been fixed for this issue – Jekoula Jan 19 '18 at 21:48
  • 1
    @schroeder It does look like maybe 3.7.25 backports the bugfixes from 4.9.2, but that isn't communicated very well if that's the case. I'm not sure why else all the bugfixes from 4.9.2 would be listed there... – AndrolGenhald Jan 19 '18 at 22:00
3

In practise yes

There was a XSS bug (XSS vulnerability was discovered in the Flash fallback files in MediaElement), affecting all versions since WordPress 3.7 (at the point where it was discovered, of course).

https://wordpress.org/news/2018/01/wordpress-4-9-2-security-and-maintenance-release/

Wordpress team fixed it, and released version 4.9.2 to fix it on the 4.9 branch. It also released version 4.8.5, 4.7.9, 4.6.10, 4.5.13, 4.4.14, 4.3.15, 4.2.19, 4.1.22, 4.0.22, 3.9.23, 3.8.25 and 3.7.25 to fix the respective branches.

You can easily view the changes and see that they are backports covering this same issue.

So, as far as you update to a newer release of those "old versions", you would be fine... if there are patches.

Now, what you need is to stay at a version for which someone (preferably Wordpress team) will issue a fix if there a new vulnerability affecting it was discovered. This is documented on https://codex.wordpress.org/Supported_Versions

And there they say:

The only current officially supported version is WordPress 4.9.1. Previous major releases before this may or may not get security updates as serious exploits are discovered.

Support Policy

WordPress will be backported security updates when possible, but there are no guarantee and no timeframe for older releases. There are no fixed period of support nor Long Term Support (LTS) version such as Ubuntu's. None of these are safe to use, except the latest series, which is actively maintained.

So, they give no warranties that they will continue doing so in the future, but are fixing the security bugs (no new features, of course). Regarding version 4.7.9 note that Debian stable wordpress package also uses the 4.7 series and this branch is likely to continue receiving security fixes (by both wordpress team and downstream maintainers) for quite a long time.

Given this, I wouldn't consider requiring that the webmaster updates to 4.9.2 if they are already at 4.7.9, as the security issues have been fixed. They are updating their wordpress. The lazy webmasters are those that installed 4.3.5, and are still running that version.

1

Just because they have been updated does not mean that all security vulnerabilities have been patched. Given WordPress are open-source and free to use, chances are they have a reasonably tight budget and limited development team. With that being the case, they will always prioritize the newer versions first with respect to security patches.

In addition to simply prioritizing newer versions, there may be inherent flaws in the older versions designs that introduce vulnerabilities that were fixed in newer versions by re-designing core attributes of the system.

I apologize about the generalness of my answer since I have rarely used WordPress in my life, but am still confident my answer is accurate. One way or another, I would trust a site dedicated to finding vulnerabilities on WordPress and if they say you should upgrade, you might just want to upgrade.

Hope it helps!

1

This is your only argument: Wordpress themselves say that you need to update to 4.9.2 in order to get the security patch. That message is provided in the link you posted.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.