WordPress MU 2.8.6 Security and Bugfix Release

WordPress MU 2.8.6 was just released and it is available for download immediately. This releases patches a XSS vulnerability in Press This and another issue with sanitizing upload file names which could be exploited to run a php file uploaded as file.php.jpg in some apache configurations. These are the same security fixes that were patched in WordPress 2.8.6. This release also addresses some MU specific bugs.

WordPress 2.8.6 Security Release

WordPress version 2.8.6 was released earlier today which addressed a couple of security issues. WordPress 2.8.6 patches a XSS vulnerability in Press This and another issue with sanitizing upload file names which could be exploited to run a php file uploaded as file.php.jpg in some apache configurations.

It is recommended to download and upgrade to version 2.8.6 or use the automatic upgrade function of WordPress under Tools > Upgrade from the admin area. WordPress 2.8.6 will be available for automatic upgrade soon.