Your message dated Fri, 02 Oct 2026 15:24:59 +0000
with message-id <[email protected]>
and subject line Bug#1148368: fixed in wordpress 6.8.10+dfsg1-0+deb13u1
has caused the Debian Bug report #1148368,
regarding wordpress: Security bug on 7.1 reported by CERT and fixed in 7.1.1
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1148368: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1148368
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: wordpress
Version: 7.1+dfsg1-1
Severity: grave
Tags: security upstream
Justification: user security hole
X-Debbugs-Cc: Debian Security Team <[email protected]>
See :
https://wordpress.org/news/2026/09/wordpress-7-1-1-maintenance-and-security-release/
https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1200/
-- System Information:
Debian Release: forky/sid
APT prefers unstable-debug
APT policy: (500, 'unstable-debug'), (500, 'stable-updates'), (500,
'stable-security'), (500, 'unstable'), (500, 'testing'), (500, 'stable'), (1,
'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 6.18.52 (SMP w/16 CPU threads; PREEMPT)
Locale: LANG=fr_FR.UTF8, LC_CTYPE=fr_FR.UTF8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled
Versions of packages wordpress depends on:
ii apache2 [httpd] 2.4.68-2
ii ca-certificates 20260816
ii default-mysql-client 1.1.1
ii libapache2-mod-php 2:8.4+99
ii libapache2-mod-php8.4 [libapache2-mod-php] 8.4.24-1
ii libjs-cropper 1.2.2-2
ii libjs-jquery-ui 1.14.2+dfsg-1
ii libjs-lodash 4.18.1+dfsg1-2
ii libjs-underscore 1.13.8~dfsg+~1.13.0-1
ii libphp-phpmailer 7.1.1-1
ii mariadb-client [virtual-mysql-client] 1:11.8.9+ds-2
ii php-gd 2:8.4+99
ii php-getid3 2.0.0~beta6+dfsg-1
ii php-mysql 2:8.4+99
ii php8.4-gd [php-gd] 8.4.24-1
ii php8.4-mysql [php-mysqlnd] 8.4.24-1
Versions of packages wordpress recommends:
ii wordpress-theme-twentytwentyfive 7.1+dfsg1-1
Versions of packages wordpress suggests:
ii mariadb-server [virtual-mysql-server] 1:11.8.9+ds-2
ii php-curl 2:8.4+99
pn php-imagick <none>
ii php-mbstring 2:8.4+99
pn php-ssh2 <none>
ii php-xml 2:8.4+99
ii php-zip 2:8.4+99
ii php8.4-curl [php-curl] 8.4.24-1
ii php8.4-mbstring [php-mbstring] 8.4.24-1
ii php8.4-xml [php-xml] 8.4.24-1
ii php8.4-zip [php-zip] 8.4.24-1
-- no debconf information
--- End Message ---
--- Begin Message ---
Source: wordpress
Source-Version: 6.8.10+dfsg1-0+deb13u1
Done: Craig Small <[email protected]>
We believe that the bug you reported is fixed in the latest version of
wordpress, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Craig Small <[email protected]> (supplier of updated wordpress package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Wed, 23 Sep 2026 20:30:44 +1000
Source: wordpress
Binary: wordpress wordpress-l10n wordpress-theme-twentytwentyfive
wordpress-theme-twentytwentyfour wordpress-theme-twentytwentythree
Architecture: source all
Version: 6.8.10+dfsg1-0+deb13u1
Distribution: trixie-security
Urgency: high
Maintainer: Craig Small <[email protected]>
Changed-By: Craig Small <[email protected]>
Description:
wordpress - weblog manager
wordpress-l10n - weblog manager - language files
wordpress-theme-twentytwentyfive - weblog manager - twentytwentyfive theme
files
wordpress-theme-twentytwentyfour - weblog manager - twentytwentyfour theme
files
wordpress-theme-twentytwentythree - weblog manager - twentytwentythree theme
files
Closes: 114873 1144955 1148368
Changes:
wordpress (6.8.10+dfsg1-0+deb13u1) trixie-security; urgency=high
.
* Three security updates
* 6.8.10 backport of security release 7.1.2 Closes: #114873
CVE-2026-87902: Unauthenticated path traversal in page-template resolution
leading to conditional RCE.
* 6.8.9 backport of security release 7.1.1 Closes: #1148368
Stored XSS in wpautop() allows an unauthenticated visitor to inject
script (subject to comment approval). CVE-2026-93485
API: set_modifiable_text() allows breaking out of a comment via
abrupt-closing sequences.
Stored XSS in some themes that support custom headers.
Specially crafted URLs can automatically install and preview an
inactive theme from WordPress.org. (Click2Shell)
Site Administrator can network-activate an installed Network-only plugin.
Authenticated Path Traversal in WP REST Templates Controller.
XML-RPC can be used to publish customize_changeset posts that bypass
checks for edit_css.
Contributor+ Arbitrary Post Overwrite.
Missing read_post check in attachment_submitbox_metadata() leaks a
private parent-post title.
Missing Authorization leads to Draft/Pending Post Slug Disclosure by
Contributor+.
Comments, including notes, can be reparented by any authenticated user.
* 6.8.8 backport of security release 7.0.4
Fixes: CVE-2026-65640 Closes: #1144955
Checksums-Sha1:
ff31ae8fcf1ad3d5660fd4d140ef666af28b5db1 2461
wordpress_6.8.10+dfsg1-0+deb13u1.dsc
e858d5e845e5b08cbd24d7003bce2700bf81deee 22359396
wordpress_6.8.10+dfsg1.orig.tar.xz
9a08d602a23da77246eafb46f8368cd5a78ab9ea 6913692
wordpress_6.8.10+dfsg1-0+deb13u1.debian.tar.xz
1d41e422fe9cec26e2e9b58d6397466e3397636f 4369808
wordpress-l10n_6.8.10+dfsg1-0+deb13u1_all.deb
06dfb929593e7fbd6a41772c14319630006882d4 7905728
wordpress-theme-twentytwentyfive_6.8.10+dfsg1-0+deb13u1_all.deb
745dc79cb2ab6e002089783a48d97fd8fdc8f2a9 2917672
wordpress-theme-twentytwentyfour_6.8.10+dfsg1-0+deb13u1_all.deb
4e042e10eb207e4d331c2ee673b71956e4818b85 2113212
wordpress-theme-twentytwentythree_6.8.10+dfsg1-0+deb13u1_all.deb
c63de337409d4882f7527e2dc91b889232197a5c 8930704
wordpress_6.8.10+dfsg1-0+deb13u1_all.deb
75b97492508824883e553c5ff095fe11be4c9e37 7782
wordpress_6.8.10+dfsg1-0+deb13u1_amd64.buildinfo
Checksums-Sha256:
65c0ee0a619be836dca57538b25f3a482f19560bdd9e7805f3b22fe4de984e3f 2461
wordpress_6.8.10+dfsg1-0+deb13u1.dsc
e28ac95cc7f732fe88157c050750625aefcb7cbf3f41557315054bc51513fdec 22359396
wordpress_6.8.10+dfsg1.orig.tar.xz
bb5b9e133487c9b9c085bd9b577865b771d5ad41fdd946831b68a440e13e4a22 6913692
wordpress_6.8.10+dfsg1-0+deb13u1.debian.tar.xz
90e6686e78d5f67d9bfec2a9aae252f8985e4d4f3c4a51e7ba2092e3aa5009be 4369808
wordpress-l10n_6.8.10+dfsg1-0+deb13u1_all.deb
018758b33769f7ac35f42985a30e12c373e6454539cbb3858e413a2bebdf05f4 7905728
wordpress-theme-twentytwentyfive_6.8.10+dfsg1-0+deb13u1_all.deb
60a83bb2530ef4b9d9978b4f93f7a5d97d60614e7da517a722467c8c55e32323 2917672
wordpress-theme-twentytwentyfour_6.8.10+dfsg1-0+deb13u1_all.deb
cc84b527514db927237c372897901592dadbb654af658e1c7d60d2db66f5a21c 2113212
wordpress-theme-twentytwentythree_6.8.10+dfsg1-0+deb13u1_all.deb
73a8161a802db8451a473e0d2c5d3a93c7fe1d9d82b35728b35ee5d69d8c08df 8930704
wordpress_6.8.10+dfsg1-0+deb13u1_all.deb
c19d10c40412d461b09ecf291de3f3fbdd1d404a5cad1a5d157503f5f4bdc010 7782
wordpress_6.8.10+dfsg1-0+deb13u1_amd64.buildinfo
Files:
a1a5078776209e001e7800958b558a15 2461 web optional
wordpress_6.8.10+dfsg1-0+deb13u1.dsc
b00a1c38c481e1165fd9adb1e0ad40dd 22359396 web optional
wordpress_6.8.10+dfsg1.orig.tar.xz
d33817dd78f2cbaa569ae6e354a8cf5a 6913692 web optional
wordpress_6.8.10+dfsg1-0+deb13u1.debian.tar.xz
20708fe08ebcc39bb107729615dc89d3 4369808 localization optional
wordpress-l10n_6.8.10+dfsg1-0+deb13u1_all.deb
fba3296252395529bc946fc7bba1adef 7905728 web optional
wordpress-theme-twentytwentyfive_6.8.10+dfsg1-0+deb13u1_all.deb
4dc877405f3e255a02af6ce56903b279 2917672 web optional
wordpress-theme-twentytwentyfour_6.8.10+dfsg1-0+deb13u1_all.deb
5cb1edec094313117b43a1d67b0321a0 2113212 web optional
wordpress-theme-twentytwentythree_6.8.10+dfsg1-0+deb13u1_all.deb
d377858e4833a55dfb8c856a3771ae84 8930704 web optional
wordpress_6.8.10+dfsg1-0+deb13u1_all.deb
5dbce50941bba7e2a0c369e255112127 7782 web optional
wordpress_6.8.10+dfsg1-0+deb13u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEXT3w9TizJ8CqeneiAiFmwP88hOMFAmq6Gm4ACgkQAiFmwP88
hONvtQ//ecw3d4TrZiMT1sqRyZJLrMdj7V8KKbFXi2huPafw6iliLKGpkY/BpuCT
yn2nCmbagbHAfAxYUPm3ndLEFASlxjdc5NQ8jqf+fL+Yun8Fw1CXDuqiv3OFzByC
5inmHG4KOnRRlm38DInhhosdsml9CWGhtyPwVrh5o8sM8mr9V5S4rgsffgveFL5h
eSSNAOSloB5LHn7s75I0BM7OrI82nk8HI/Srso28egaxxi/Km3B2WJPsxlZnVVVF
knWYBLmKiksn8ua50PKd9vaipNymNTwNB3e68AgWMOpQLldpNMW5OMpe++wjWCVo
N42Z8GtDOQN2w5Z/fGvDaPcidFqoijixWC23tpwMQJ24onicdnG0YgBqGwTlZDGz
Uq06xWyRrBhBNxcsuiyUjjsbczD0L2FQPvZgrSgL3rt4vEoUxVakzgeQdx8tmvxf
u03h0YiobNsYvIowniYeT1Pewa4Cbc0bGJMirBtkvAhZbzh4AHHX24AW1oKNdhZA
sPAjhqlqoN3ZFN/dREghWsSbyxtvodgxM1tBXhh6qmIRuoFTnfd4U/HCVq3ZeTFO
AT2iV1iZvebzo+PsSYzQz2xC9WmCZYXfPb5f9YAFAc+DlVtts9gxgz4hrBTZIAdp
4J0FCW2l+ix0HjN2FamNeKs9VE0uxkV+ZDz1tOvNbfMVY9HjhPA=
=UlA6
-----END PGP SIGNATURE-----
pgpLLti7WqYuC.pgp
Description: PGP signature
--- End Message ---
