{"id":387,"date":"2026-08-07T13:57:41","date_gmt":"2026-08-07T11:57:41","guid":{"rendered":"https:\/\/helloblog.io\/hu\/wordpress-7-0-3-biztonsagi-frissites\/"},"modified":"2026-08-07T14:06:39","modified_gmt":"2026-08-07T12:06:39","slug":"wordpress-7-0-3-biztonsagi-frissites","status":"publish","type":"post","link":"https:\/\/helloblog.io\/hu\/wordpress-7-0-3-biztonsagi-frissites\/","title":{"rendered":"Megjelent a WordPress 7.0.3: tizenk\u00e9t biztons\u00e1gi jav\u00edt\u00e1s \u00e9rkezett"},"content":{"rendered":"\n<p>A WordPress 7.0.3 biztons\u00e1gi kiad\u00e1s: t\u00f6bb, elt\u00e9r\u0151 s\u00falyoss\u00e1g\u00fa s\u00e9r\u00fcl\u00e9kenys\u00e9get jav\u00edt. Ha WordPress-oldalt \u00fczemeltetsz, telep\u00edtsd miel\u0151bb, k\u00fcl\u00f6n\u00f6sen akkor, ha t\u00f6bbfelhaszn\u00e1l\u00f3s vagy nyitott regisztr\u00e1ci\u00f3s k\u00f6rnyezetet kezelsz.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Azonnali teend\u0151<\/h4>\n\n\n<p>Ez biztons\u00e1gi friss\u00edt\u00e9s. Ne v\u00e1rd meg a k\u00f6vetkez\u0151 karbantart\u00e1si ablakot: k\u00e9sz\u00edts ment\u00e9st, majd friss\u00edtsd a WordPress-t 7.0.3-ra.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">\u00cdgy friss\u00edts WordPress 7.0.3-ra<\/h2>\n\n\n\n<p>A friss\u00edt\u00e9st a WordPress vez\u00e9rl\u0151pultj\u00e1b\u00f3l ind\u00edthatod, vagy let\u00f6ltheted a kiad\u00e1s csomagj\u00e1t. Az automatikus h\u00e1tt\u00e9rfriss\u00edt\u00e9st t\u00e1mogat\u00f3 oldalak r\u00f6videsen magukt\u00f3l is friss\u00fclnek, de \u00e9rdemes ellen\u0151rizni, hogy a folyamat val\u00f3ban lefutott-e.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>L\u00e9pj be az adminfel\u00fcletre.<\/li>\n\n\n<li>Nyisd meg a <strong>Vez\u00e9rl\u0151pult \u2192 Friss\u00edt\u00e9sek<\/strong> oldalt.<\/li>\n\n\n<li>Kattints a <strong>Friss\u00edt\u00e9s most<\/strong> gombra.<\/li>\n\n\n<li>A friss\u00edt\u00e9s ut\u00e1n ellen\u0151rizd a fut\u00f3 WordPress-verzi\u00f3t, valamint az oldal kritikus funkci\u00f3it.<\/li>\n\n<\/ol>\n\n\n<a href=\"https:\/\/wordpress.org\/wordpress-7.0.3.zip\" class=\"download-card\" download>\n                <span class=\"download-icon\"><i class=\"fa-duotone fa-file-zipper\"><\/i><\/span>\n                <span class=\"download-info\">\n                    <span class=\"download-title\">WordPress 7.0.3 let\u00f6lt\u00e9se<\/span>\n                    <span class=\"download-meta\"><span class=\"download-filename\">wordpress-7.0.3.zip<\/span><\/span>\n                <\/span>\n                <span class=\"download-action\"><i class=\"fa-duotone fa-arrow-down-to-line\"><\/i><\/span>\n            <\/a>\n\n\n<p>A kiad\u00e1shoz tartoz\u00f3 r\u00e9szletes dokument\u00e1ci\u00f3t a <a href=\"https:\/\/wordpress.org\/documentation\/wordpress-version\/version-7-0-3\/\">WordPress 7.0.3 HelpHub-oldal\u00e1n<\/a> tal\u00e1lod.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Milyen s\u00e9r\u00fcl\u00e9kenys\u00e9geket jav\u00edt a kiad\u00e1s?<\/h2>\n\n\n\n<p>A csomag t\u00f6bb XSS-probl\u00e9m\u00e1t, jogosults\u00e1gi hib\u00e1t, adatsziv\u00e1rg\u00e1st \u00e9s h\u00e1l\u00f3zati k\u00e9r\u00e9skezel\u00e9si hib\u00e1t z\u00e1r le. Az XSS (cross-site scripting) sor\u00e1n a t\u00e1mad\u00f3 olyan kliensoldali k\u00f3dot juttathat az oldalba, amelyet m\u00e1s felhaszn\u00e1l\u00f3 b\u00f6ng\u00e9sz\u0151je futtat.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>Bejelentkez\u00e9si k\u00e9perny\u0151, hiteles\u00edt\u00e9s el\u0151tti reflected XSS:<\/strong> a hiba PHP-k\u00f3d futtat\u00e1s\u00e1ig is elvezethetett.<\/li>\n\n\n<li><strong>Bejegyz\u00e9sek emoji-be\u00e1ll\u00edt\u00e1si eleme, Contributor+ stored XSS:<\/strong> a Contributor vagy magasabb jogosults\u00e1g\u00fa felhaszn\u00e1l\u00f3 t\u00e1rolt XSS-t helyezhetett el a bejegyz\u00e9sben.<\/li>\n\n\n<li><strong>Post Content blokk, Contributor+ stored XSS:<\/strong> a Post Content blokkon kereszt\u00fcl is t\u00e1rolt XSS-t lehetett bejuttatni.<\/li>\n\n\n<li><strong>Quick Edit, Contributor+ stored XSS:<\/strong> sok felhaszn\u00e1l\u00f3t kezel\u0151 oldalakon a gyorsszerkeszt\u0151ben jelentkezett a t\u00e1rolt XSS.<\/li>\n\n\n<li><strong>Post Date blokk, Contributor+ stored XSS:<\/strong> a Post Date blokk is lehet\u0151s\u00e9get adott t\u00e1rolt XSS-re.<\/li>\n\n\n<li><strong>Multisite jogosults\u00e1gkiterjeszt\u00e9s:<\/strong> bekapcsolt felhaszn\u00e1l\u00f3i regisztr\u00e1ci\u00f3 mellett egy felhaszn\u00e1l\u00f3 \u00faj webhelyet hozhatott l\u00e9tre a h\u00e1l\u00f3zatban.<\/li>\n\n\n<li><strong>Latest Comments blokk, inform\u00e1ci\u00f3sziv\u00e1rg\u00e1s:<\/strong> a blokk megjelen\u00edthette jelsz\u00f3val v\u00e9dett bejegyz\u00e9sek hozz\u00e1sz\u00f3l\u00e1sait.<\/li>\n\n\n<li><strong>Bejegyz\u00e9s-slugok felder\u00edt\u00e9se:<\/strong> a hiba lehet\u0151v\u00e9 tette a bejegyz\u00e9sek slugjainak felsorol\u00e1s\u00e1t.<\/li>\n\n\n<li><strong>Megjegyz\u00e9sek a kommentfeedekben:<\/strong> a kommentfeedekb\u0151l megjegyz\u00e9sek sziv\u00e1roghattak ki.<\/li>\n\n\n<li><strong>Author+ CSS-injekt\u00e1l\u00e1s:<\/strong> a safe CSS attrib\u00fatumsz\u0171r\u0151 megker\u00fcl\u00e9s\u00e9vel Author vagy magasabb jogosults\u00e1g\u00fa felhaszn\u00e1l\u00f3 CSS-t injekt\u00e1lhatott.<\/li>\n\n\n<li><strong>E-mail-c\u00edm meger\u0151s\u00edt\u00e9s\u00e9nek megker\u00fcl\u00e9se:<\/strong> ki lehetett ker\u00fclni az e-mail-c\u00edm meger\u0151s\u00edt\u00e9s\u00e9re szolg\u00e1l\u00f3 folyamatot.<\/li>\n\n\n<li><strong>SSRF az URL-ellen\u0151rz\u00e9sben:<\/strong> a szerveroldali k\u00e9r\u00e9sind\u00edt\u00e1si hiba link-local c\u00edmtartom\u00e1nyok fel\u00e9 is engedett k\u00e9r\u00e9seket k\u00fcldeni.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">R\u00e9gebbi WordPress-verzi\u00f3k \u00e9s 7.1 RC2<\/h2>\n\n\n\n<p>A biztons\u00e1gi jav\u00edt\u00e1sokat sz\u00fcks\u00e9g szerint visszaportolj\u00e1k minden olyan \u00e1gra, amely m\u00e9g jogosult biztons\u00e1gi friss\u00edt\u00e9sekre; ez jelenleg a 4.7-es \u00e1gig terjed. A visszaportol\u00e1sok m\u00e9g folyamatban vannak, \u00e9s akkor jelennek meg, amikor elk\u00e9sz\u00fclnek.<\/p>\n\n\n\n<p>Fontos, hogy akt\u00edv t\u00e1mogat\u00e1st kiz\u00e1r\u00f3lag a WordPress legfrissebb kiad\u00e1sa kap. A WordPress 7.1 RC2 m\u00e1r megjelent, \u00e9s minden r\u00e1 vonatkoz\u00f3 jav\u00edt\u00e1st tartalmaz.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A bejelentkez\u00e9si k\u00e9perny\u0151 XSS-hib\u00e1j\u00e1nak azonos\u00edt\u00f3ja<\/h2>\n\n\n\n<p>A bejelentkez\u00e9si k\u00e9perny\u0151t \u00e9rint\u0151 XSS-s\u00e9r\u00fcl\u00e9kenys\u00e9g publikus azonos\u00edt\u00f3i: <a href=\"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-52p2-r8wf-jcrf\">CVE-2026-64638 \/ GHSA-52p2-r8wf-jcrf<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Friss\u00edt\u00e9s ut\u00e1n ezt ellen\u0151rizd<\/h2>\n\n\n\n<p>Ellen\u0151rizd, hogy val\u00f3ban a 7.0.3 fut-e, majd pr\u00f3b\u00e1ld ki a bejelentkez\u00e9st, a szerkeszt\u00e9st \u00e9s a saj\u00e1t integr\u00e1ci\u00f3id kritikus folyamatait. R\u00e9gebbi WordPress-\u00e1gon ne tekints a k\u00e9s\u0151bbi visszaportol\u00e1sra helyettes\u00edt\u0151 megold\u00e1sk\u00e9nt: ahol lehet, \u00e1llj \u00e1t a leg\u00fajabb stabil verzi\u00f3ra.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Hivatkoz\u00e1sok \/ Forr\u00e1sok<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/wordpress.org\/news\/2026\/08\/wordpress-7-0-3-release\/\" target=\"_blank\" rel=\"noopener noreferrer\">WordPress 7.0.3 release<\/a><\/li><li><a href=\"https:\/\/github.com\/WordPress\/wordpress-develop\/security\/advisories\/GHSA-52p2-r8wf-jcrf\" target=\"_blank\" rel=\"noopener noreferrer\">CVE-2026-64638 \/ GHSA-52p2-r8wf-jcrf<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>A WordPress 7.0.3 tizenk\u00e9t biztons\u00e1gi probl\u00e9m\u00e1t jav\u00edt, k\u00f6zt\u00fck XSS-, SSRF- \u00e9s jogosults\u00e1gkezel\u00e9si hib\u00e1kat. Friss\u00edtsd az \u00e9rintett oldalakat miel\u0151bb.<\/p>\n","protected":false},"author":4,"featured_media":386,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[166,167,165,10,164],"class_list":["post-387","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-biztonsag","tag-biztonsagi-frissites","tag-multisite","tag-ssrf","tag-wordpress","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/comments?post=387"}],"version-history":[{"count":1,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/387\/revisions"}],"predecessor-version":[{"id":388,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/387\/revisions\/388"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media\/386"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media?parent=387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/categories?post=387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/tags?post=387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}