The WordPress 6.9.4 security update is out, and it exists because of a rough 24 hours in core. 6.9.2 shipped fixes for ten vulnerabilities and broke template loading on a lot of sites. 6.9.3 went out fast to stop that. Then the security team found that some of the original security fixes had not been applied properly in the scramble.
I have seen this pattern before: a regression in a security release forces a second patch, and the second patch misses part of the job. It is frustrating for maintainers, but that is what backporting fixes across several branches looks like. The gap matters here, because the bugs left half fixed can hand an attacker the whole site.
Why the WordPress 6.9.4 security update is not optional
This is not a small bug fix. It re-applies three critical fixes that WordPress 6.9.2 only got halfway through, so waiting for the automatic background update to reach you is not a good plan.
- PclZip path traversal: an old bug class that still bites. During decompression an attacker can write files outside the directory they are supposed to land in.
- XXE in getID3: WordPress uses the external getID3 library to read metadata out of media files, and it had an XML External Entity hole.
- Notes authorization bypass: a logic flaw in the Notes feature let users past permission checks they should have failed.
If the previous update left you looking at a white screen or broken templates, I wrote up why WordPress 6.9.3 was necessary and how the Stringable object handling broke sites.
Updating from the command line
The dashboard button works. WP-CLI is faster, it does not die on a PHP timeout, and it lets you verify the checksums right after the update, which is why I reach for it instead. These are the commands I run.
# Update WordPress core to 6.9.4
wp core update
# Verify that the update was successful and files are intact
wp core verify-checksums
# Flush transients and object cache to prevent old security tokens from persisting
wp cache flushOn a fleet of sites you will sometimes hit a race condition where the auto-updater lands on some environments and fails on others. WP-CLI at least gives you a clear exit code when the database migration step goes wrong. The dashboard does not.
If chasing these releases is eating your dev hours, I can take it off your plate. I have been wrestling with WordPress since the 4.x days.
For maintainers
The WordPress 6.9.4 security update closes out the issues introduced earlier this week. Update fatigue after back-to-back releases is fair, but skipping this one leaves the three holes above open. The 6.9.4 documentation and the release notes have the full technical detail.
