Your message dated Mon, 21 Sep 2026 12:21:38 +0000
with message-id <[email protected]>
and subject line Bug#1148368: fixed in wordpress 7.1.1+dfsg1-1
has caused the Debian Bug report #1148368,
regarding wordpress: Security bug on 7.1 reported by CERT and fixed in 7.1.1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148368: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148368
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wordpress
Version: 7.1+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
See :
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1200/
-- System Information:
Debian Release: forky/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500,
'stable-security'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1,
'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 6.18.52 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF8, LC_CTYPE=fr_FR.UTF8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages wordpress depends on:
ii apache2 [httpd] 2.4.68-2
ii ca-certificates 20260816
ii default-mysql-client 1.1.1
ii libapache2-mod-php 2:8.4+99
ii libapache2-mod-php8.4 [libapache2-mod-php] 8.4.24-1
ii libjs-cropper 1.2.2-2
ii libjs-jquery-ui 1.14.2+dfsg-1
ii libjs-lodash 4.18.1+dfsg1-2
ii libjs-underscore 1.13.8~dfsg+~1.13.0-1
ii libphp-phpmailer 7.1.1-1
ii mariadb-client [virtual-mysql-client] 1:11.8.9+ds-2
ii php-gd 2:8.4+99
ii php-getid3 2.0.0~beta6+dfsg-1
ii php-mysql 2:8.4+99
ii php8.4-gd [php-gd] 8.4.24-1
ii php8.4-mysql [php-mysqlnd] 8.4.24-1
Versions of packages wordpress recommends:
ii wordpress-theme-twentytwentyfive 7.1+dfsg1-1
Versions of packages wordpress suggests:
ii mariadb-server [virtual-mysql-server] 1:11.8.9+ds-2
ii php-curl 2:8.4+99
pn php-imagick <none>
ii php-mbstring 2:8.4+99
pn php-ssh2 <none>
ii php-xml 2:8.4+99
ii php-zip 2:8.4+99
ii php8.4-curl [php-curl] 8.4.24-1
ii php8.4-mbstring [php-mbstring] 8.4.24-1
ii php8.4-xml [php-xml] 8.4.24-1
ii php8.4-zip [php-zip] 8.4.24-1
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 7.1.1+dfsg1-1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Mon, 21 Sep 2026 21:21:36 +1000
Source: wordpress
Architecture: source
Version: 7.1.1+dfsg1-1
Distribution: unstable
Urgency: high
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Closes: 1148368
Changes:
wordpress (7.1.1+dfsg1-1) unstable; urgency=high
.
* New upstream security release Closes: #1148368
Stored XSS in wpautop() allows an unauthenticated visitor to inject
script (subject to comment approval). CVE-2026-93485
API: set_modifiable_text() allows breaking out of a comment via
abrupt-closing sequences.
Stored XSS in some themes that support custom headers.
Specially crafted URLs can automatically install and preview an
inactive theme from WordPress.org. (Click2Shell)
Site Administrator can network-activate an installed Network-only plugin.
Authenticated Path Traversal in WP REST Templates Controller.
XML-RPC can be used to publish customize_changeset posts that bypass
checks for edit_css.
Contributor+ Arbitrary Post Overwrite.
Missing read_post check in attachment_submitbox_metadata() leaks a
private parent-post title.
Missing Authorization leads to Draft/Pending Post Slug Disclosure by
Contributor+.
Comments, including notes, can be reparented by any authenticated user.
Checksums-Sha1:
7b439e90f62a7ef1138a98f3ae28c11917311919 2359 wordpress_7.1.1+dfsg1-1.dsc
5dd435f4236a7dd9355cfe9ad2b78c66e28101dc 28033048
wordpress_7.1.1+dfsg1.orig.tar.xz
b2465d8a34dd48788411fde20c6e7830eab6c59c 1603688
wordpress_7.1.1+dfsg1-1.debian.tar.xz
c39570c0cfbf417b35d742b8be0c489748c9b8ef 7229
wordpress_7.1.1+dfsg1-1_amd64.buildinfo
Checksums-Sha256:
62f6274ec1013e82f1e0b9e9e319b12f00fd87e9154e47651b623e3f19dbd4d3 2359
wordpress_7.1.1+dfsg1-1.dsc
65b73fd0416a3d208705cc619b54050070775ef6fac9ff67eed49cd6cdb1b3f2 28033048
wordpress_7.1.1+dfsg1.orig.tar.xz
eeff5e978e54f083d7c5edd69b7cb88b845dd26fcc28b6508285614722424b93 1603688
wordpress_7.1.1+dfsg1-1.debian.tar.xz
364a0f75fb98a13b315ec9b5039a764f66ad13c559b15dd309b456c8e73f3dca 7229
wordpress_7.1.1+dfsg1-1_amd64.buildinfo
Files:
672d2b6e0afe5837f9e681b53025b28b 2359 web optional wordpress_7.1.1+dfsg1-1.dsc
4540177ea4d6fc11955eb4e481e091b0 28033048 web optional
wordpress_7.1.1+dfsg1.orig.tar.xz
c99018ffbe7bf16c67bd5b1d8fa668a1 1603688 web optional
wordpress_7.1.1+dfsg1-1.debian.tar.xz
5abe1d0c161c9f3fc37de7b9609da320 7229 web optional
wordpress_7.1.1+dfsg1-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmqxE6AACgkQAiFmwP88
hOOx0g//ToI8qpHOM0QrVuEkzq2ccKZIU8JNCaMVvbRomwbG/6xmWfiiZqlRzNth
rqBypAGehuxXxmckhrJklnuj/W3Trd3O79gy8HhUkxm75SxcwHdisVa3T4qtvMi5
npftj2u7nItM7uVHfnPYdmbT/jr7hBflssZ3Xp0yGr2DpFh2XjI4baMdcqnqklYi
k+en/pwvtyh3+yQmkGIJQ5GE2/sFZZVj5VVvYv+QGifLYCrec1ZUThyYgoIFzuRx
krpV4vZPoY9BRW4jjh5iu/RTXoFUzlKqPs4rKiE9SaAY76/qQ2V/t5u9S1DGaZYA
Q9M3Wl/eqEn2qv6jxeOWBdz3v/d21FeFDBqj88f7aUHhbrTfVjFwv5xl6VnB6rw1
ANbJrls5kxgyUTC6/v+B6xWP3gL/OwxWD3BhXKPpDIspv1kbJmsmo1bfpnVm4htm
xVLtinXe3mCj+ySZCga0Ia6M/wUsjvbuvumEM/047oHvCrmiaP/SMQ21ohSci43r
LNgR3gYxXG0o4Z0iVo/1Aaa1YW1lGWABdWxS0sDoiOb4farQVHtRdwGC4bKPCqgz
1vSCuPqZwDQGM78kpteDscT0vo4jFCL4hu0v54Dne4Uw96fqOIB7ajYIh3hOeJ9o
GRTyR/cR9B23wN4aOboNBxOFotlA0W2CPk3zdY+yi8aHWWX9ELg=
=w9Bm
-----END PGP SIGNATURE-----
pgpVJ4ki2qP8_.pgp
Description: PGP signature
--- End Message ---
