# MA-414.092014: MyCERT Advisory - Security updates for WordPress

**Date:** 12 Sep 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-414.092014  
**Advisory ID:** MA-414.092014

---

**1.0 Introduction**
WordPress 3.9.2 has been released to address multiple vulnerabilities, one of which could allow a possible denial of service issue in PHP's XML processing. WordPress 3.7.3 or 3.8.3 users will be updated to 3.7.4 or 3.8.4. Users operating older, unsupported versions of WordPress are encouraged to upgrade to 3.9.2.
**2.0 Impact**
Exploitation of one of these vulnerabilities could potentially allow the attacker to gain unauthorized access by using forged authentication cookies.
**3.0 Affected Products**
- Wordpress 3.7.3 or 3.8.3 users
- Older and unsupported versions of Wordpress users
**4.0 Recommendation**
- Wordpress users are highly advice to download latest version of Wordpress available at the below URL: [Download Wordpress 3.9.2](http://wordpress.org/download/)
- Another way is by utilizing the Wordpress interface, in which users can go to **Dashboard > Updates** and click **"Update Now"**.
Note: Sites that support automatic background updates will be updated to WordPress 3.9.2 within 12 hours. For users that are still on WordPress 3.8.3 or 3.7.3, they will be updated to 3.8.4 or 3.7.4. Wordpress does not support older versions, hence users are recommended to update to 3.9.2.
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
**5.0 References**
- [WordPress Releases Security Update](https://www.us-cert.gov/ncas/current-activity/2014/09/04/WordPress-Releases-Security-Update)
- [WordPress 3.9.2 Security Release](http://wordpress.org/news/2014/08/wordpress-3-9-2/)