CVS commit: pkgsrc/www/wordpress

["Takahiro Kambe" <taca%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   taca
Date:           Wed Oct  7 15:51:22 UTC 2026

Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

Log Message:
www/wordpress: update to 7.0.7

7.0.7 (2026-10-06)

Security updates

This release features one security fix. Because this is a security release,
it is recommended that you update your sites immediately.

The security team would like to thank the following people for responsibly
reporting vulnerabilities, and allowing them to be fixed in this release:

* A stored XSS on the Comments administration page, exploitable via pending
  comments, reported by Thomas Chauchefoin at Trail of Bits

* A DoS issue in the WP_Http::make_absolute_url() method, reported by
  Anthropic

* A second-Order SQL injection in WordPress WXR export, reported by
  Anthropic

* A weakness allowing Author role users to sticky posts, reported by
  Anthropic

* Unauthenticated disclosure of comments on private & unpublished posts,
  reported by Ananda Dhakal from Patchstack

* Imgur embeds are vulnerable to XSS, reported by Zhengyu Liu, Jingcheng
  Yang, and Gavin Zhong

* Forgeable parameters passed to the {status}_{type} hook can lead to action
  name collision, reported by Alex Concha of the WordPress security team


To generate a diff of this commit:
cvs rdiff -u -r1.123 -r1.124 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.104 -r1.105 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.123 pkgsrc/www/wordpress/Makefile:1.124
--- pkgsrc/www/wordpress/Makefile:1.123 Thu Sep 24 03:39:34 2026
+++ pkgsrc/www/wordpress/Makefile       Wed Oct  7 15:51:22 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.123 2026/09/24 03:39:34 taca Exp $
+# $NetBSD: Makefile,v 1.124 2026/10/07 15:51:22 taca Exp $
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.6
+VERSION=               7.0.7
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.104 pkgsrc/www/wordpress/distinfo:1.105
--- pkgsrc/www/wordpress/distinfo:1.104 Thu Sep 24 03:39:34 2026
+++ pkgsrc/www/wordpress/distinfo       Wed Oct  7 15:51:22 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.104 2026/09/24 03:39:34 taca Exp $
+$NetBSD: distinfo,v 1.105 2026/10/07 15:51:22 taca Exp $
 
-BLAKE2s (wordpress-7.0.6.tar.gz) = 351f30c4696063d8985f8a77ca1ae810706965cbe49eb73f4a190bb4d0d7399c
-SHA512 (wordpress-7.0.6.tar.gz) = 1805862d7cfa4129d79f4779043430384388ae1244c511e6725b43473dfaf7f6b21e8f535c802d58a745dde1213d71349a519db0eeee343fae8185e11bd15b9e
-Size (wordpress-7.0.6.tar.gz) = 29557662 bytes
+BLAKE2s (wordpress-7.0.7.tar.gz) = 7f522b768f11ddec8f7436de99602b0e8689a5945ac8cfecd544bf715186d9a8
+SHA512 (wordpress-7.0.7.tar.gz) = d14a33ceb5b2a7fcfe1d2db6e2becac4395664965051903a0819fd1923c6b78e397e96c9246fca2815207950a288fc4ab125316e8c7b3b140aca7d4119cef4e0
+Size (wordpress-7.0.7.tar.gz) = 29557971 bytes