CVS commit: pkgsrc/www/wordpress

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Thu Sep 24 03:39:34 UTC 2026

Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

Log Message:
www/wordpress: update to 7.0.6

7.0.5 (2026-09-17)

Security Updates

* An issue allowing a crafted URL to install and preview a theme from
  WordPress.org reported by Paulos Yibelo and pwn.ai

* A stored cross-site scripting (XSS) issue in custom header images on some
  themes reported by Jeremy Felt of the WordPress Security Team

* An information disclosure issue exposing the title of a private parent
  post reported by HDWSec

* An HTML API issue allowing modified text to break out of an HTML comment
  reported by Jeremy Felt of the WordPress Security Team

* A multisite issue allowing a site administrator to network-activate a
  network-only plugin reported by Jesse McNeil

* A Contributor+ arbitrary post overwrite issue reported by Anthropic

* An authenticated path traversal issue in the REST API templates controller
  reported by Anthropic

* An authorization issue allowing any authenticated user to reparent
  comments, including notes, reported by viridis

* An XML-RPC issue allowing changeset posts to bypass the custom CSS
  capability check reported by Ben Bidner of the WordPress Security Team

* A Contributor+ disclosure of draft and pending post slugs reported by
  hermanhms

* An unauthenticated stored cross-site scripting (XSS) issue via paragraph
  formatting, subject to comment approval, reported by Rafie Muhammad
  (Awesome Motive, Inc.)

7.0.6 (2026-09-22)

Security Updates (CVE-2026-87902)

* An unauthenticated path traversal issue in page-template resolution
  leading to conditional remote code execution reported by Robert Ressl


To generate a diff of this commit:
cvs rdiff -u -r1.122 -r1.123 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.103 -r1.104 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.122 pkgsrc/www/wordpress/Makefile:1.123
--- pkgsrc/www/wordpress/Makefile:1.122 Thu Aug 13 16:40:40 2026
+++ pkgsrc/www/wordpress/Makefile       Thu Sep 24 03:39:34 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.122 2026/08/13 16:40:40 taca Exp $
+# $NetBSD: Makefile,v 1.123 2026/09/24 03:39:34 taca Exp $
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.4
+VERSION=               7.0.6
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.103 pkgsrc/www/wordpress/distinfo:1.104
--- pkgsrc/www/wordpress/distinfo:1.103 Thu Aug 13 16:40:40 2026
+++ pkgsrc/www/wordpress/distinfo       Thu Sep 24 03:39:34 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.103 2026/08/13 16:40:40 taca Exp $
+$NetBSD: distinfo,v 1.104 2026/09/24 03:39:34 taca Exp $
 
-BLAKE2s (wordpress-7.0.4.tar.gz) = 21b5e961341f2539d4bff9192fa1daaf1945f0587aa82dcde1c68adda2bbe354
-SHA512 (wordpress-7.0.4.tar.gz) = c20add4a81efe7f8e44abeec6bbf28c9ef80ca400b9fce1f9605fde5599a37dbe61435bb6a57d6cfbff9a4aba9bcde0d5a37ca1198f90b707aba70d895df4893
-Size (wordpress-7.0.4.tar.gz) = 29551415 bytes
+BLAKE2s (wordpress-7.0.6.tar.gz) = 351f30c4696063d8985f8a77ca1ae810706965cbe49eb73f4a190bb4d0d7399c
+SHA512 (wordpress-7.0.6.tar.gz) = 1805862d7cfa4129d79f4779043430384388ae1244c511e6725b43473dfaf7f6b21e8f535c802d58a745dde1213d71349a519db0eeee343fae8185e11bd15b9e
+Size (wordpress-7.0.6.tar.gz) = 29557662 bytes