# MA-432.112014: MyCERT Advisory - WordPress Releases Security Update

**Date:** 26 Nov 2014  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-432.112014  
**Advisory ID:** MA-432.112014

---

**1.0     Introduction**
WordPress 4.0.1 has been released to address multiple vulnerabilities, one of which could allow a site to be compromised by a remote attacker. WordPress 3.9.2 and earlier are affected by this vulnerability.
**2.0     Impact**
These updates address vulnerabilities that could potentially enable anonymous users to compromise a site.
**3.0 Affected Products**
Listed below is the affected product:
- WordPress 3.9.2 and earlier
**4.0 Recommendation**
WordPress recommends users to update their software by following either of these instructions below:
- Wordpress users are highly advice to download latest version of Wordpress available at the below URL: [Download WordPress 4.0.1](https://wordpress.org/download/)
- Another way is by utilizing the Wordpress interface, in which users can go to **Dashboard > Updates** and click **"Update Now"**.
**Note:** Sites that support automatic background updates will be updated to WordPress 4.0.1 within the next few hours. If you are still on WordPress 3.9.2, 3.8.4, or 3.7.4, you will be updated to 3.9.3, 3.8.5, or 3.7.5 to keep everything secure. Wordpress does not support older versions, hence users are recommended to update to 4.0.1
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail : [[email protected]](/cdn-cgi/l/email-protection) or [[email protected]](/cdn-cgi/l/email-protection)
Phone : 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web : <https://www.mycert.org.my>
Twitter : <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps:  [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0     References**
- WordPress Releases Security Update;
<https://www.us-cert.gov/ncas/current-activity/2014/11/21/WordPress-Releases-Security-Update>
- WordPress 4.0.1 Security Release;
[https://wordpress.org/news/2014/11/wordpress-4-0-1/]( https://wordpress.org/news/2014/11/wordpress-4-0-1/)
- WordPress Updates Address Critical Flaws (November 21 & 24, 2014);
<http://itsecuritynews.info/2014/11/25/wordpress-updates-address-critical-flaws-november-21-24-2014/>