CVS commit: [pkgsrc-2026Q3] pkgsrc/www/wordpress

["Benny Siegert" <bsiegert%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   bsiegert
Date:           Fri Oct  2 12:48:46 UTC 2026

Modified Files:
        pkgsrc/www/wordpress [pkgsrc-2026Q3]: Makefile distinfo

Log Message:
Pullup ticket #7252 - requested by taca
www/wordpress: security fix

Revisions pulled up:
- www/wordpress/Makefile                                        1.123
- www/wordpress/distinfo                                        1.104

---
   Module Name: pkgsrc
   Committed By:        taca
   Date:                Thu Sep 24 03:39:34 UTC 2026

   Modified Files:
        pkgsrc/www/wordpress: Makefile distinfo

   Log Message:
   www/wordpress: update to 7.0.6

   7.0.5 (2026-09-17)

   Security Updates

   * An issue allowing a crafted URL to install and preview a theme from
     WordPress.org reported by Paulos Yibelo and pwn.ai

   * A stored cross-site scripting (XSS) issue in custom header images on some
     themes reported by Jeremy Felt of the WordPress Security Team

   * An information disclosure issue exposing the title of a private parent
     post reported by HDWSec

   * An HTML API issue allowing modified text to break out of an HTML comment
     reported by Jeremy Felt of the WordPress Security Team

   * A multisite issue allowing a site administrator to network-activate a
     network-only plugin reported by Jesse McNeil

   * A Contributor+ arbitrary post overwrite issue reported by Anthropic

   * An authenticated path traversal issue in the REST API templates controller
     reported by Anthropic

   * An authorization issue allowing any authenticated user to reparent
     comments, including notes, reported by viridis

   * An XML-RPC issue allowing changeset posts to bypass the custom CSS
     capability check reported by Ben Bidner of the WordPress Security Team

   * A Contributor+ disclosure of draft and pending post slugs reported by
     hermanhms

   * An unauthenticated stored cross-site scripting (XSS) issue via paragraph
     formatting, subject to comment approval, reported by Rafie Muhammad
     (Awesome Motive, Inc.)

   7.0.6 (2026-09-22)

   Security Updates (CVE-2026-87902)

   * An unauthenticated path traversal issue in page-template resolution
     leading to conditional remote code execution reported by Robert Ressl


To generate a diff of this commit:
cvs rdiff -u -r1.122 -r1.122.2.1 pkgsrc/www/wordpress/Makefile
cvs rdiff -u -r1.103 -r1.103.2.1 pkgsrc/www/wordpress/distinfo

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/www/wordpress/Makefile
diff -u pkgsrc/www/wordpress/Makefile:1.122 pkgsrc/www/wordpress/Makefile:1.122.2.1
--- pkgsrc/www/wordpress/Makefile:1.122 Thu Aug 13 16:40:40 2026
+++ pkgsrc/www/wordpress/Makefile       Fri Oct  2 12:48:46 2026
@@ -1,8 +1,8 @@
-# $NetBSD: Makefile,v 1.122 2026/08/13 16:40:40 taca Exp $
+# $NetBSD: Makefile,v 1.122.2.1 2026/10/02 12:48:46 bsiegert Exp $
 
 DISTNAME=              wordpress-${VERSION}
 PKGNAME=               ${PHP_PKG_PREFIX}-${DISTNAME}
-VERSION=               7.0.4
+VERSION=               7.0.6
 CATEGORIES=            www
 MASTER_SITES=          https://wordpress.org/
 

Index: pkgsrc/www/wordpress/distinfo
diff -u pkgsrc/www/wordpress/distinfo:1.103 pkgsrc/www/wordpress/distinfo:1.103.2.1
--- pkgsrc/www/wordpress/distinfo:1.103 Thu Aug 13 16:40:40 2026
+++ pkgsrc/www/wordpress/distinfo       Fri Oct  2 12:48:46 2026
@@ -1,5 +1,5 @@
-$NetBSD: distinfo,v 1.103 2026/08/13 16:40:40 taca Exp $
+$NetBSD: distinfo,v 1.103.2.1 2026/10/02 12:48:46 bsiegert Exp $
 
-BLAKE2s (wordpress-7.0.4.tar.gz) = 21b5e961341f2539d4bff9192fa1daaf1945f0587aa82dcde1c68adda2bbe354
-SHA512 (wordpress-7.0.4.tar.gz) = c20add4a81efe7f8e44abeec6bbf28c9ef80ca400b9fce1f9605fde5599a37dbe61435bb6a57d6cfbff9a4aba9bcde0d5a37ca1198f90b707aba70d895df4893
-Size (wordpress-7.0.4.tar.gz) = 29551415 bytes
+BLAKE2s (wordpress-7.0.6.tar.gz) = 351f30c4696063d8985f8a77ca1ae810706965cbe49eb73f4a190bb4d0d7399c
+SHA512 (wordpress-7.0.6.tar.gz) = 1805862d7cfa4129d79f4779043430384388ae1244c511e6725b43473dfaf7f6b21e8f535c802d58a745dde1213d71349a519db0eeee343fae8185e11bd15b9e
+Size (wordpress-7.0.6.tar.gz) = 29557662 bytes