WordPress 6.4.2 Maintenance & Security Release – WordPress News

WordPress 6.4.2 is now available!

This minor release features 7 bug fixes in Core. The fixes include a bug fix for an issue causing stylesheet and theme directories to sometimes return incorrect results.

This release also features one security fix. Because this is a security release, it is recommended that you update your sites immediately.

You can download WordPress 6.4.2 from WordPress.org, or visit your WordPress Dashboard, click “Updates”, and then click “Update Now”. If you have sites that support automatic background updates, the update process will begin automatically.

WordPress 6.4.2 is a short-cycle release. The next major release will be version 6.5 released in early 2024.

For more information on this release, please visit the HelpHub site.

Security updates included in this release

The security team addressed the following vulnerability in this release.

• A Remote Code Execution vulnerability that is not directly exploitable in core, however the security team feels that there is a potential for high severity when combined with some plugins, especially in multisite installs.

To help the security team and WordPressers around the world, you are encouraged to responsibly report vulnerabilities. This allows vulnerabilities to be fixed in future releases.

Thank you to these WordPress contributors

This release was led by Aaron Jorbin.

WordPress 6.4.2 would not have been possible without the contributions of the following people. Their asynchronous coordination to deliver maintenance and security fixes into a stable release is a testament to the power and capability of the WordPress community.

Aaron Jorbin, Aki Hamano, Akira Tachibana, Alex Concha, Angela Jin, Anton Vlasenko, Barry, bernhard-reiter, Caleb Burks, Corey Worrell, crstauf, Darren Ethier (nerrad), David Baumwald, Dennis Snell, Dion Hulse, Erik, Fabian Todt, Felix Arntz, Héctor Prieto, ironprogrammer, Isabel Brison, Jb Audras, Jeffrey Paul, Jessica Lyschik, Joe McGill, John Blackbourn, Jonathan Desrosiers, Kharis Sulistiyono, Krupal Panchal, Kylen Downs, meta4, Mike Schroder, Mukesh Panchal, partyfrikadelle, Peter Wilson, Pieterjan Deneys, rawrly, rebasaurus, Sergey Biryukov, Tonya Mork, vortfu

How to contribute

To get involved in WordPress core development, head over to Trac, pick a ticket, and join the conversation in the #core. Need help? Check out the Core Contributor Handbook.

As a final reminder, The WordPress Security Team will never email you requesting that you install a plugin or theme on your site, and will never ask for an administrator username and password. Please stay vigilant against phishing attacks.

Thanks to @angelasjin and @desrosj for proofreading.