wordpress - Debian Package Tracker

general

source: wordpress (main)
version: 7.1.2+dfsg1-1
maintainer: Craig Small (DMD)
arch: all
std-ver: 4.6.2
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 5.7.11+dfsg1-0+deb11u1
o-o-sec: 5.7.14+dfsg1-0+deb11u1
oldstable: 6.1.9+dfsg1-0+deb12u1
old-sec: 6.1.9+dfsg1-0+deb12u1
stable: 6.8.3+dfsg1-0+deb13u1
stable-sec: 6.8.10+dfsg1-0+deb13u1
stable-p-u: 6.8.10+dfsg1-0+deb13u1
testing: 7.1.2+dfsg1-1
unstable: 7.1.2+dfsg1-1

versioned links

5.7.11+dfsg1-0+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
5.7.14+dfsg1-0+deb11u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.1.9+dfsg1-0+deb12u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.8.3+dfsg1-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
6.8.10+dfsg1-0+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.0.3+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
7.1.2+dfsg1-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

wordpress (7 bugs: 0, 4, 3, 0)
wordpress-theme-twentytwentyfive
wordpress-theme-twentytwentyfour
wordpress-theme-twentytwentythree

action needed

1 binary package has unsatisfiable dependencies high

The dependencies of wordpress-l10n=7.0.3+dfsg1-1 cannot be satisfied in unstable on amd64 because: unsatisfied dependency on wordpress (= 7.0.3+dfsg1-1)

Created: 2026-09-10 Last update: 2026-10-05 14:30

Marked for autoremoval on 10 November due to rabbitmq-server: #1149180 high

Version 7.1.2+dfsg1-1 of wordpress is marked for autoremoval from testing on Tue 10 Nov 2026. It depends (transitively) on rabbitmq-server, affected by #1149180. You should try to prevent the removal by fixing these RC bugs.

Created: 2026-10-04 Last update: 2026-10-05 13:33

2 security issues in trixie high

There are 2 open security issues in trixie.

1 important issue:

CVE-2019-8943: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.

1 issue left for the package maintainer to handle:

CVE-2022-3590: (postponed; to be fixed through a stable update) WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

You can find information about how to handle this issue in the security team's documentation.

Created: 2023-06-11 Last update: 2026-10-01 04:30

2 security issues in sid high

There are 2 open security issues in sid.

2 important issues:

CVE-2019-8943: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVE-2022-3590: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Created: 2022-07-04 Last update: 2026-10-01 04:30

2 security issues in forky high

There are 2 open security issues in forky.

2 important issues:

CVE-2019-8943: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVE-2022-3590: WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.

Created: 2025-08-09 Last update: 2026-10-01 04:30

9 security issues in bookworm high

There are 9 open security issues in bookworm.

4 important issues:

CVE-2026-64638: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
CVE-2026-65640: WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.
CVE-2026-87902: An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this can lead to RCE.
CVE-2026-93485: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Automattic WordPress core allows DOM-Based XSS. This issue affects WordPress versions 7.1 before 7.1.1; 7.0 through 7.0.4; 6.9 through 6.9.7; 6.8 through 6.8.8; 6.7 through 6.7.7; 6.6 through 6.6.7; 6.5 through 6.5.10; 6.4 through 6.4.10; 6.3 through 6.3.10; 6.2 through 6.2.11; 6.1 through 6.1.12; 6.0 through 6.0.14; 5.9 through 5.9.16; 5.8 through 5.8.15; 5.7 through 5.7.17; 5.6 through 5.6.19; 5.5 through 5.5.20; 5.4 through 5.4.21; 5.3 through 5.3.23; 5.2 through 5.2.26; 5.1 through 5.1.24; 5.0 through 5.0.27; 4.9 through 4.9.31; 4.8 through 4.8.30; and 4.7 through 4.7.35. The Unauthenticated Stored XSS vulnerability in the WordPress core can be reproduced on a default WordPress installation. Comment moderation is disabled by default, and the requirement for commenters to have a previously approved comment can be bypassed.

3 issues postponed or untriaged:

CVE-2019-8943: (postponed; to be fixed through a stable update) WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVE-2022-3590: (postponed; to be fixed through a stable update) WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
TEMP-1036689-1CA7FB: (postponed; to be fixed through a stable update)

2 ignored issues:

CVE-2012-6707: WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
CVE-2023-5692: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.

Created: 2026-08-07 Last update: 2026-10-01 04:30

debian/patches: 1 patch with invalid metadata, 1 patch to forward upstream high

Among the 5 debian patches available in version 7.1.2+dfsg1-1 of the package, we noticed the following issues:

1 patch with invalid metadata that ought to be fixed.
1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-09-23 20:02

7 security issues in bullseye high

There are 7 open security issues in bullseye.

2 important issues:

CVE-2026-64638: WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/).
CVE-2026-65640: WordPress is vulnerable to a remote code execution vulnerability via malicious Postscript file upload by an Author level user or higher. Prerequisites: * Imagick and Ghostscript in use on the server * A malicious user with the `upload_files` capability This issue affects all versions of WordPress. Version 7.0.4 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7.

4 issues postponed or untriaged:

CVE-2012-6707: (postponed; to be fixed through a stable update) WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
CVE-2019-8943: (postponed; to be fixed through a stable update) WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVE-2022-3590: (needs triaging) WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
CVE-2021-44223: (needs triaging) WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

1 ignored issue:

CVE-2023-5692: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.

Created: 2026-08-07 Last update: 2026-08-24 19:00

10 security issues in buster high

There are 10 open security issues in buster.

6 important issues:

CVE-2019-8943: WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). An attacker (who has privileges to crop an image) can write the output image to an arbitrary directory via a filename containing two image extensions and ../ sequences, such as a filename ending with the .jpg?/../../file.jpg substring.
CVE-2023-5692: WordPress Core is vulnerable to Sensitive Information Exposure in versions up to, and including, 6.4.3 via the redirect_guess_404_permalink function. This can allow unauthenticated attackers to expose the slug of a custom post whose 'publicly_queryable' post status has been set to 'false'.
CVE-2024-4439: WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.
CVE-2024-6307: WordPress Core is vulnerable to Stored Cross-Site Scripting via the HTML API in various versions prior to 6.5.5 due to insufficient input sanitization and output escaping on URLs. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2024-31111: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Automattic WordPress allows Stored XSS.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9.
CVE-2024-32111: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Automattic WordPress allows Relative Path Traversal.This issue affects WordPress: from 6.5 through 6.5.4, from 6.4 through 6.4.4, from 6.3 through 6.3.4, from 6.2 through 6.2.5, from 6.1 through 6.1.6, from 6.0 through 6.0.8, from 5.9 through 5.9.9, from 5.8 through 5.8.9, from 5.7 through 5.7.11, from 5.6 through 5.6.13, from 5.5 through 5.5.14, from 5.4 through 5.4.15, from 5.3 through 5.3.17, from 5.2 through 5.2.20, from 5.1 through 5.1.18, from 5.0 through 5.0.21, from 4.9 through 4.9.25, from 4.8 through 4.8.24, from 4.7 through 4.7.28, from 4.6 through 4.6.28, from 4.5 through 4.5.31, from 4.4 through 4.4.32, from 4.3 through 4.3.33, from 4.2 through 4.2.37, from 4.1 through 4.1.40.

4 issues postponed or untriaged:

CVE-2012-6707: (postponed; to be fixed through a stable update) WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a WordPress site from a web host that uses a recent PHP version to a different web host that uses PHP 5.2. These use cases are plausible (but very unlikely) based on statistics showing widespread deployment of WordPress with obsolete PHP versions.
CVE-2022-3590: (postponed; to be fixed through a stable update) WordPress is affected by an unauthenticated blind SSRF in the pingback feature. Because of a TOCTOU race condition between the validation checks and the HTTP request, attackers can reach internal hosts that are explicitly forbidden.
CVE-2018-14028: (postponed; to be fixed through a stable update) In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then execute the file. This represents a security risk in limited scenarios where an attacker (who does have the required capabilities for plugin uploads) cannot simply place arbitrary PHP code into a valid plugin ZIP file and upload that plugin, because a machine's wp-content/plugins directory permissions were set up to block all new plugins.
CVE-2021-44223: (needs triaging) WordPress before 5.8 lacks support for the Update URI plugin header. This makes it easier for remote attackers to execute arbitrary code via a supply-chain attack against WordPress installations that use any plugin for which the slug satisfies the naming constraints of the WordPress.org Plugin Directory but is not yet present in that directory.

Created: 2022-07-04 Last update: 2024-06-29 19:18

Depends on packages which need a new maintainer normal

The packages that wordpress depends on which need a new maintainer are:

dh-linktree (#980413)
- Build-Depends: dh-linktree

Created: 2021-01-18 Last update: 2026-10-05 11:31

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.6.2).

Created: 2024-04-07 Last update: 2026-09-23 18:00

news

[rss feed]

[2026-10-02] Accepted wordpress 6.8.10+dfsg1-0+deb13u1 (source all) into proposed-updates (Debian FTP Masters) (signed by: Craig Small)
[2026-10-01] wordpress 7.1.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-09-28] Accepted wordpress 6.8.10+dfsg1-0+deb13u1 (source all) into stable-security (Debian FTP Masters) (signed by: Craig Small)
[2026-09-23] Accepted wordpress 7.1.2+dfsg1-1 (source) into unstable (Craig Small)
[2026-09-21] Accepted wordpress 7.1.1+dfsg1-1 (source) into unstable (Craig Small)
[2026-08-25] wordpress 7.1+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-08-21] Accepted wordpress 7.1+dfsg1-1 (source) into unstable (Craig Small)
[2026-08-12] Accepted wordpress 6.8.7+dfsg1-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Craig Small)
[2026-08-10] Accepted wordpress 6.8.7+dfsg1-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Craig Small)
[2026-08-07] Accepted wordpress 7.0.3+dfsg1-1 (source) into unstable (Craig Small)
[2026-07-24] Accepted wordpress 6.8.6+dfsg1-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Craig Small)
[2026-07-23] Accepted wordpress 6.8.6+dfsg1-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Craig Small)
[2026-07-23] wordpress 7.0.2+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-07-21] Accepted wordpress 7.0.2+dfsg1-1 (source) into unstable (Craig Small)
[2026-06-20] wordpress 7.0+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-06-15] Accepted wordpress 7.0+dfsg1-1 (source) into unstable (Craig Small)
[2026-05-28] wordpress 6.9.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-05-08] wordpress REMOVED from testing (Debian testing watch)
[2026-03-24] wordpress 6.9.4+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-03-18] Accepted wordpress 6.9.4+dfsg1-1 (source) into unstable (Craig Small)
[2026-01-26] wordpress 6.9+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2026-01-19] Accepted wordpress 6.9+dfsg1-1 (source) into unstable (Craig Small)
[2025-12-21] Accepted wordpress 6.8.3+dfsg1-0+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2025-12-21] Accepted wordpress 6.8.3+dfsg1-0+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2025-12-20] Accepted wordpress 6.1.9+dfsg1-0+deb12u1 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2025-12-09] Accepted wordpress 6.1.9+dfsg1-0+deb12u1 (source) into oldstable-security (Debian FTP Masters) (signed by: Utkarsh Gupta)
[2025-11-02] Accepted wordpress 5.7.14+dfsg1-0+deb11u1 (source) into oldoldstable-security (Utkarsh Gupta)
[2025-10-15] wordpress 6.8.3+dfsg1-1 MIGRATED to testing (Debian testing watch)
[2025-10-09] Accepted wordpress 6.8.3+dfsg1-1 (source) into unstable (Craig Small)
[2025-05-16] wordpress 6.8.1+dfsg1-1 MIGRATED to testing (Debian testing watch)

bugs [bug history graph]

all: 13
RC: 0
I&N: 9
M&W: 3
F&P: 1
patch: 0

links

homepage
lintian
buildd: logs, reproducibility, debcheck
popcon
browse source code
other distros
security tracker
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 6.7.2+dfsg1-1.1ubuntu2
8 bugs
patches for 6.7.2+dfsg1-1.1ubuntu2