WordPress 6.9.4 security release
Released on , WordPress 6.9.4 is a follow-up security update that completes fixes that were not fully applied in earlier point releases.
WordPress 6.9.4 is now available and should be treated as an urgent patch for any site running the 6.9 branch.
Why 6.9.4 was shipped so quickly
WordPress 6.9.2 and 6.9.3 shipped the previous day to address 10 security issues and a bug affecting template file loading on a limited number of sites.
After release, the WordPress Security Team identified that not all security fixes had been fully applied. Version 6.9.4 delivers the additional changes required to fully remediate the affected areas.
Security fixes included
This release resolves a PclZip path traversal issue that was reported independently by Francesco Carlucci and kaminuma.
It also addresses an authorisation bypass affecting the Notes feature, reported by kaminuma.
A separate fix closes an XXE issue in the external getID3 library, reported by Youssef Achtatal.
The Security Team credits responsible disclosure, with specific thanks to Thomas Kräftner for reporting and investigation support.
Update guidance for WordPress site owners
Because this is a security release, update immediately. You can apply the update from your WordPress Dashboard by opening Updates and selecting Update Now, or by downloading the package from WordPress.org.
Sites configured for automatic background updates should begin the process without manual intervention, but it is still sensible to verify the installed version after the maintenance window.
Operational notes for WordPress administrators
Release sequencing and risk management
When security releases are issued in quick succession, it is usually an indication that a remediation required follow-on changes once initial patch coverage was rechecked. For managed fleets, prioritise patch roll-out, then confirm completion across all environments, including staging and any “standby” instances used for failover.
Template loading bug context
If your site was in the small cohort impacted by template file loading behaviour in 6.9.2/6.9.3, treat 6.9.4 as the stable endpoint for that release chain while also closing out the remaining security work.
FAQ
Is WordPress 6.9.4 a security update?
Yes. WordPress 6.9.4 is a security release and is recommended for immediate installation.
Why was WordPress 6.9.4 released after 6.9.2 and 6.9.3?
The Security Team determined that not all security fixes in the earlier releases were fully applied. Version 6.9.4 contains the additional fixes required to complete remediation.
What vulnerabilities are fixed in WordPress 6.9.4?
The release includes fixes for a PclZip path traversal issue, an authorisation bypass on the Notes feature, and an XXE issue in the external getID3 library.
How do I update to WordPress 6.9.4?
Update from your WordPress Dashboard under Updates by selecting Update Now, or download the release from WordPress.org. If automatic background updates are enabled, the update may start automatically.
Where can I read the official announcement?
You can read the release announcement here: WordPress 6.9.4 release.
