Thursday, May 22, 2025
HomeCVE/vulnerabilityWordPress 4.7.3 released with patch for six security issues, but not for...

WordPress 4.7.3 released with patch for six security issues, but not for CSRF

Published on

SIEM as a Service

Follow Us on Google News

Most expected WordPress 4.7.3 is now available for update. This security update covers six security issues that exists with WordPress version 4.7.2.

Security issues:

  1. Cross-site scripting (XSS) via media file metadata. Reported by Chris Andrè Dale, Yorick Koster, and Simon P. Briggs.
  2. Control characters can trick redirect URL validation. Reported by Daniel Chatfield.
  3. Unintended files can be deleted by administrators using the plugin deletion functionality. Reported by xuliang.
  4. Cross-site scripting (XSS) via video URL in YouTube embeds. Reported by Marc Montpas.
  5. Cross-site scripting (XSS) via taxonomy term names. Reported by Delta.
  6. Cross-site request forgery (CSRF) in Press This leading to excessive use server resources. Reported by Sipke Mellema.

As indicated by Koster, who recognized the vulnerabilities in the playlist functionality, the attacker needs to persuade a editor or administrator into transferring a MP3 file containing exceptionally made metadata.

Utilizing this trap the attacker’s code will be executed when the metadata is prepared by the renderTracks() or wp_playlist_shortcode() capacities.

- Advertisement - Google News

In any case, there is a CSRF vulnerability in WordPress that still has not been fixed, the flaw was found in July 2016 and the details for the exploitation were not disclosed.

How to update

WordPress 4.7.3 contains 39 maintenance fixes to the 4.7 release series. Updates are simple Dashboard >> Updates >> Update Now.

Sites that bolster automatic background updates are now refreshing to WordPress 4.7.3.

It is always a good idea to backup your WordPress before proceeding with update, if there is any issues,you can restore your website.

WordPress-4.7.3  MD5 : 79c278099df49ad089e659c89533d9c0

Wordpress-4.7.3  SHA-1 : 26d362ed9a41522b1e32f1c6b87ae2f16737cdd6

Also Read:

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Hackers Target Mobile Users Using PWA JavaScript to Bypass Browser Security

A sophisticated new injection campaign has been uncovered, targeting mobile users through malicious third-party...

Docker Zombie Malware Infects Containers for Crypto Mining and Self-Replication

A novel malware campaign targeting containerized infrastructures has emerged, exploiting insecurely exposed Docker APIs...

Hackers Masquerade as Organizations to Steal Payroll Logins and Redirect Payments from Employees

ReliaQuest, hackers have deployed a cunning search engine optimization (SEO) poisoning scheme to orchestrate...

PupkinStealer Exploits Web Browser Passwords and App Tokens to Exfiltrate Data Through Telegram

A newly identified .NET-based information-stealing malware, dubbed PupkinStealer (also known as PumpkinStealer in some...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Volkswagen Car Hack Exposes Owner’s Personal Data and Service Records

Tech-savvy Volkswagen owner has uncovered critical security flaws in the My Volkswagen app that...

PoC Code Published for Linux nftables Security Vulnerability

Security researchers have published proof-of-concept (PoC) exploit code for CVE-2024-26809, a high-severity double-free vulnerability in...

Cisco IOS XE Vulnerability Allows Attackers to Gain Elevated Privileges

Cisco has issued an urgent security advisory (ID: cisco-sa-iosxe-privesc-su7scvdp) following the discovery of multiple...