Beginner's Guide for WordPress - Start your WordPress Blog in minutes.
Choosing the Best
WordPress Hosting
How to Easily
Install WordPress
WordPress Plugins
View all Guides

WordPress 3.0.2 – Mandatory Security Release (Update Now)

Last updated on by
Special WordPress Hosting offer for WPBeginner Readers
WordPress 3.0.2 – Mandatory Security Release (Update Now)

WordPress 3.0.2 is made available today, and it is a mandatory security update for all previous WordPress versions. This maintenance release fixes a moderate security issue where a malicious Author-level user could gain further access to the site. This release also addresses a handful of bugs, and provides some additional security enhancements. Big thanks to Vladimir Kolesnikov for detailed and responsible disclosure of the security issue!

We advise that you update immediately even if you do not have untrusted users. (Use our ultimate guide to Upgrade WordPress to make sure you do everything right)

Full list of updates made in this version:

  • Fix moderate security issue where a malicious Author-level user could gain further access to the site.
  • Remove pingback/trackback blogroll whitelisting feature as it can easily be abused.
  • Fix canonical redirection for permalinks containing %category% with nested categories and paging.
  • Fix occasional irrelevant error messages on plugin activation.
  • Minor XSS fixes in request_filesystem_credentials() and when deleting a plugin.
  • Clarify the license in the readme
  • Multisite: Fix the delete_user meta capability
  • Multisite: Force current_user_can_for_blog() to run map_meta_cap() even for super admins
  • Multisite: Fix ms-files.php content type headers when requesting a URL with a query string
  • Multisite: Fix the usage of the SUBDOMAIN_INSTALL constant for upgraded WordPress MU installs

What are you waiting for? Upgrade NOW!!!

Editorial Staff at WPBeginner is a team of WordPress experts led by Syed Balkhi. Page maintained by Syed Balkhi.

WPBeginner's Video Icon
Our HD-Quality tutorial videos for WordPress Beginners will teach you how to use WordPress to create and manage your own website in about an hour. Get started now »


  1. Dean Saliba says:

    Has anyone else experienced this?

    I installed this update on three test blogs and when the upgrade was complete I was unable to access the main page, the admin page or even the FTP.

    I contacted my host’s support and they said those three blogs had somehow had their permissions changed. Didn’t happen to any of my others that did not receive the upgrade. :/

  2. camu says:

    (Self promotion) You should switch to my plugin to manage your commenters’ subscriptions :-)

  3. camu says:

    Hi there, does the nightly-build of WP 3.1 already include the fix?

Add a Comment

We're glad you have chosen to leave a comment. Please keep in mind that all comments are moderated according to our comment policy, and all links are nofollow. Do NOT use keywords in the name field. Let's have a personal and meaningful conversation.