{"id":10561,"date":"2013-09-11T18:15:19","date_gmt":"2013-09-12T01:15:19","guid":{"rendered":"http:\/\/37prime.wordpress.com\/?p=10561"},"modified":"2013-09-11T18:15:19","modified_gmt":"2013-09-12T01:15:19","slug":"wordpress-3-6-1","status":"publish","type":"post","link":"https:\/\/37prime.com\/news\/2013\/09\/11\/wordpress-3-6-1\/","title":{"rendered":"WordPress 3.6.1"},"content":{"rendered":"<p><a href=\"http:\/\/codex.wordpress.org\/Version_3.6.1\" target=\"_blank\">WordPress 3.6.1<\/a> is now available.<\/p>\n<blockquote>\n<h2>Summary<\/h2>\n<p>From the <a title=\"http:\/\/wordpress.org\/news\/2013\/09\/wordpress-3-6-1\/\" href=\"http:\/\/wordpress.org\/news\/2013\/09\/wordpress-3-6-1\/\">announcement post<\/a>, this maintenance release addresses 13 bugs with version 3.6.<\/p>\n<p>Additionally: Version 3.6.1 fixes three security issues:<\/p>\n<ul>\n<li>Remote Code Execution: Block unsafe PHP de-serialization that could occur in limited situations and setups, which can lead to remote code execution. Reported by Tom Van Goethem. CVE pending.<\/li>\n<li>Privilege Escalation: Prevent a user with an Author role, using a specially crafted request, from being able to create a post &#8220;written by&#8221; another user. Reported by Anakorn Kyavatanakij. CVE pending.<\/li>\n<li>Link Injection \/ Open Redirect: Fix insufficient input validation that could result in redirecting or leading a user to another website. Reported by Dave Cummo, a Northrup Grumman subcontractor for the U.S. Centers for Disease Control and Prevention. CVE pending.<\/li>\n<\/ul>\n<p>Additional security hardening:<\/p>\n<ul>\n<li>Updated security restrictions around file uploads to mitigate the potential for cross-site scripting. The extensions .swf and .exe are no longer allowed by default, and .htm and .html are only allowed if the user has the ability to use unfiltered HTML.<\/li>\n<\/ul>\n<p>A full log of the changes made for 3.6.1 can be found at <a title=\"http:\/\/core.trac.wordpress.org\/log\/branches\/3.6?stop_rev=24972&amp;rev=25345\" href=\"http:\/\/core.trac.wordpress.org\/log\/branches\/3.6?stop_rev=24972&amp;rev=25345\">http:\/\/core.trac.wordpress.org\/log\/branches\/3.6?stop_rev=24972&amp;rev=25345<\/a>.<\/p><\/blockquote>\n<p><img loading=\"lazy\" decoding=\"async\" alt=\"WordPress 3.6.1\" src=\"http:\/\/37prime.com\/news\/wp-content\/uploads\/2013\/09\/WordPress-3.6.1.jpg\" width=\"960\" height=\"540\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WordPress 3.6.1 is now available. Summary From the announcement post, this maintenance release addresses 13 bugs with version 3.6. Additionally: Version 3.6.1 fixes three security issues: Remote Code Execution: Block unsafe PHP de-serialization that could occur in limited situations and setups, which can lead to remote code execution. Reported by Tom Van Goethem. CVE pending. &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/37prime.com\/news\/2013\/09\/11\/wordpress-3-6-1\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;WordPress 3.6.1&#8221;<\/span><\/a><\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[4],"tags":[529,2648,2748,936,3238],"class_list":["post-10561","post","type-post","status-publish","format-standard","hentry","category-news","tag-blog","tag-security","tag-software-updates","tag-tech","tag-wordpress"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pcNtU-2Kl","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/10561","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/comments?post=10561"}],"version-history":[{"count":0,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/posts\/10561\/revisions"}],"wp:attachment":[{"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/media?parent=10561"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/categories?post=10561"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/37prime.com\/news\/wp-json\/wp\/v2\/tags?post=10561"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}