Home / WordPress / WordPress 5.4.1 – 7 security patches and 17 bug fixes

WordPress 5.4.1 – 7 security patches and 17 bug fixes

Published On: April 30th, 2020|Categories: WordPress|Tags: releases, WordPress 5.4|3 min read|

On April 29, 2020, WordPress 5.4.1 was released to the public.

This security and maintenance release features 17 bug fixes in addition to 7 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.

WordPress 5.4.1 is a short-cycle security and maintenance release. The next major release will be WordPress version 5.5.

WordPress 5.4.1 – Security Updates

Seven security issues affect WordPress versions 5.4 and earlier. If you haven’t yet updated to 5.4, all WordPress versions since 3.7 have also been updated to fix the following security issues:

Props to Muaz Bin Abdus Sattar and Jannes who both independently reported an issue where password reset tokens were not properly invalidated
Props to ka1n4t for finding an issue where certain private posts can be viewed unauthenticated
Props to Evan Ricafort for discovering an XSS issue in the Customizer
Props to Ben Bidner from the WordPress Security Team who discovered an XSS issue in the search block
Props to Nick Daugherty from WordPress VIP / WordPress Security Team who discovered an XSS issue in wp-object-cache
Props to Ronnie Goodrich (Kahoots) and Jason Medeiros who independently reported an XSS issue in file uploads.
Props to Weston Ruter for fixing a stored XSS vulnerability in the WordPress customizer.
Additionally, an authenticated XSS issue in the block editor was discovered by Nguyen the Duc in WordPress 5.4 RC1 and RC2. It was fixed in 5.4 RC5. We wanted to be sure to give credit and thank them for all of their work in making WordPress more secure.

WordPress 5.4.1 – Maintenance updates

WordPress 5.4.1 also fixes some regressions introduced in version 5.4:

#49838 – Accessibility: Fix the headings hierarchy on the Freedoms page
#49798 – Customize: Give the WordPress logo a white background for dark mode browsers
#49853 – Mail: Make the check for empty post title in wp-mail.php more resilient
#49753 – Media: Remove display: none; from the (visually hidden) <input type="file"> button used in Plupload to select files for uploading. Fixes selecting files in Edge <= 44 and iOS Safari
#49772 – Privacy: Support additional elements (table, ol, ul) in privacy policy guide new styling
#49802 – Privacy: Make the deprecated wp_get_user_request_data() function available on front end
#49645 – REST API: Fix revisions controller get_item permission check
#49648 – REST API: Fix _fields filtering of registered rest fields
#49824 – Site Health: Instantiation prevents use of some hooks by plugins
#49759 – Taxonomy: Un-deprecate category_link and tag_link filters
#49974 – Block Editor updates

WordPress 5.4.1 – List of Files Revised

/wp-admin/css/about.css
/wp-admin/css/edit.css
/wp-admin/freedoms.php
/wp-admin/images/w-logo-blue.png
/wp-admin/includes/deprecated.php
/wp-includes/assets/script-loader-packages.php
/wp-includes/blocks/rss.php
/wp-includes/blocks/search.php
/wp-includes/cache.php
/wp-includes/class-wp-customize-manager.php
/wp-includes/class-wp-object-cache.php
/wp-includes/class-wp-query.php
/wp-includes/css/media-views.css
/wp-includes/deprecated.php
/wp-includes/formatting.php
/wp-includes/post.php
/wp-includes/rest-api/endpoints/class-wp-rest-controller.php
/wp-includes/rest-api/endpoints/class-wp-rest-revisions-controller.php
/wp-includes/taxonomy.php
/wp-includes/user.php
/wp-includes/version.php
/wp-mail.php
/wp-settings.php

WordPress 5.4.1 – Updated packages

@wordpress/block-directory: 1.5.8
@wordpress/block-editor: 3.7.8
@wordpress/block-library: 2.14.8
@wordpress/edit-post: 3.13.10
@wordpress/editor: 9.12.8
@wordpress/format-library: 1.14.8

WordPress 5.4.1 – Installation/Update Information

To download WordPress 5.4.1, update automatically from the Dashboard > Updates menu in your site’s admin area or visit https://wordpress.org/download/release-archive/.

If you have sites that support automatic background updates, they’ve already started the update process.

For step-by-step instructions on installing and updating WordPress: