CVS commit: pkgsrc/www/wordpress

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Aug 12 15:16:59 UTC 2026

Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

Log Message:
www/wordpress: update to 7.0.3

7.0.3 (2026-08-06)

Security updates

This release features several security fixes.  Because this is a security
release, it is recommended that you update your sites immediately.

The security team would like to thank the following people for responsibly
reporting vulnerabilities, and allowing them to be fixed in this release:

* A Contributor+ stored cross-site scripting (XSS) issue in the Post Date
  block reported by Alex Concha of the WordPress Security Team

* A Contributor+ stored cross-site scripting (XSS) issue in the Post Content
  block reported by n05ec

* An information disclosure issue in the Latest Comments block exposing
  comments on password-protected posts reported by Ehtisham Siddiqui of the
  WordPress Security Team

* A bypass of the email address confirmation flow reported by 0ways

* An Author+ CSS injection issue via a bypass of the safe CSS attribute
  filter reported by Anthropic

* A Contributor+ stored cross-site scripting (XSS) issue in posts via the
  emoji settings element reported by Asaf Mozes (amosec)

* A privilege escalation issue on multisite networks with user registration
  enabled, allowing a user to create a new site reported by Aikido Security

* A server-side request forgery (SSRF) issue in URL validation allowing
  requests to link-local ranges reported by Andrew Mohawk and multiple
  independent reporters

* A pre-auth reflected cross-site scripting (XSS) issue on the login screen
  with potential to lead to PHP code execution reported by the team at
  pwn.ai

* A disclosure of notes in comment feeds reported by Elio Gubser

* An enumeration of post slugs reported by HDWSec

* A Contributor+ stored cross-site scripting (XSS) issue in Quick Edit on
  sites with a large number of users reported by Naveen S and Ajmal
  Moochingal


To generate a diff of this commit:
cvs rdiff -u -r1.120 -r1.121 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.101 -r1.102 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.120 pkgsrc/www/wordpress/Makefile:1.121
--- pkgsrc/www/wordpress/Makefile:1.120 Thu Jul 30 23:12:09 2026
+++ pkgsrc/www/wordpress/Makefile       Wed Aug 12 15:16:59 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.120 2026/07/30 23:12:09 wen Exp $
+# $NetBSD: Makefile,v 1.121 2026/08/12 15:16:59 taca Exp $
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.2
+VERSION=               7.0.3
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.101 pkgsrc/www/wordpress/distinfo:1.102
--- pkgsrc/www/wordpress/distinfo:1.101 Thu Jul 30 23:12:09 2026
+++ pkgsrc/www/wordpress/distinfo       Wed Aug 12 15:16:59 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.101 2026/07/30 23:12:09 wen Exp $
+$NetBSD: distinfo,v 1.102 2026/08/12 15:16:59 taca Exp $
 
-BLAKE2s (wordpress-7.0.2.tar.gz) = 59f24d9e91966372b83a1929a612cf11b061d100804010d7d890eb5e84dda7f2
-SHA512 (wordpress-7.0.2.tar.gz) = 1ef3a6307b3716798e1c20851aef9de2e8818bc8ead41e75521bdb560a440c848d52030f713fa64d3ddaaadfd0474761751305ff6d793724231f3402c92080b1
-Size (wordpress-7.0.2.tar.gz) = 29551444 bytes
+BLAKE2s (wordpress-7.0.3.tar.gz) = eb397a09280a9e111c05abff788be46e4e69d3cd1ef0fbb62eb89c5a78f2f304
+SHA512 (wordpress-7.0.3.tar.gz) = 1cd29afbe1895f02658822d5786b2ba0720cd3eb03b4f1f22b696db820b751fd84af8a71e2e1a232d5b8691d4cb686e0fe0fbddd16022c699fcad8edd24b4791
+Size (wordpress-7.0.3.tar.gz) = 29550735 bytes