Automattic Wordpress Update Version 6.9.2
Your rating
Rate update installation process
Risk factor
No ratings yet. Be the first to rate this update.
AI enhanced content
Update Summary
WordPress 6.9.2 is a security release addressing multiple vulnerabilities, including SSRF, XSS, authorization bypasses, path traversal, XXE, and denial-of-service weaknesses. Immediate updating is recommended.
Update Details
Security
- Fixed a blind SSRF vulnerability.
- Fixed a PoP-chain weakness in the HTML API and Block Registry.
- Fixed a regular expression denial-of-service weakness in numeric character references.
- Fixed stored XSS vulnerabilities in navigation menus and through the data-wp-bind directive.
- Fixed an XSS vulnerability allowing client-side templates to be overridden in the admin area.
- Fixed an AJAX query-attachments authorization bypass.
- Fixed a PclZip path traversal vulnerability.
- Fixed an authorization bypass in the Notes feature.
- Fixed an XXE vulnerability in the external getID3 library and coordinated an upstream getID3 fix.
Hints
- Update immediately through the WordPress Dashboard by selecting Updates and then Update Now, or download WordPress 6.9.2 from WordPress.org.
- Sites supporting automatic background updates will begin updating automatically.
- Security fixes are being backported to eligible branches through WordPress 4.7 as they become ready; only the latest WordPress version is actively supported.
Product Information
Vendor: Automattic
Product: Wordpress
Product type: Software
Platform: Web
Version: 6.9.2
Vendor information published: Mar 10, 2026
Original release notes: View on vendor site
Published on updatealert.io: Oct 24, 2026
Description: WordPress is a free and open platform for creating websites and blogs.