WordPress 4.9.7 Update Fixes Pair of Security Vulnerabilitie

Millions of WordPress sites around the world were at risk from a pair of related file deletion vulnerabilities that potentially could have enabled an attacker to delete arbitrary files. A new version of open-source content management system WordPress, 4.9.7, was released on July 5 that patches a pair of security vulnerabilities that could expose WordPress sites to risk. Both security vulnerabilities are arbitrary file deletion issues. Researchers at RIPS Tech publicly reported the first issue on June 26, while WordPress security firm Wordfence discovered the second flaw on July 2. In addition to the two vulnerabilities, WordPress 4.9.7 provides fixes for 17 other bugs to improve stability. "WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory," WordPress warned in an advisory. WordPress is one of the most widely deployed content management systems on the internet, powering upward of 75 million websites. The new update follows the WordPress 4.9.6 milestone that was released on May 17, which provided users with privacy enhancements to help meet the European Union’s General Data Protection Regulation (GDPR) rules.