WordPress 6.3.2 – Maintenance and Security release

This security and maintenance release features 19 bug fixes on Core, 22 bug fixes for the Block Editor, and 8 security fixes.

Security updates included in this release:

• Marc Montpas of Automattic for finding a potential disclosure of user email addresses.
• Marc Montpas of Automattic for finding an RCE POP Chains vulnerability.
• Rafie Muhammad and Edouard L of Patchstack along with a WordPress commissioned third-party audit for each independently identifying a XSS issue in the post link navigation block.
• Jb Audras of the WordPress Security Team and Rafie Muhammad of Patchstack for each independently discovering an issue where comments on private posts could be leaked to other users.
• John Blackbourn (WordPress Security Team), James Golovich, J.D Grimes, Numan Turle, WhiteCyberSec for each independently identifying a way for logged-in users to execute any shortcode.
• mascara7784 and a third-party security audit for identifying a XSS vulnerability in the application password screen.
• Jorge Costa of the WordPress Core Team for identifying XSS vulnerability in the footnotes block.
• s5s and raouf_maklouf for independently identifying a cache poisoning DoS vulnerability.