Now is your last chance to buy a lifetime license before we switch to annual pricing. Existing licenses will be unaffected.
read more
Posted on May 21, 2024

Oxygen 4.8.3 Now Available - Security Update

hello world!

Important – if you encounter issues after updating, you should:

  • For large sites, wait ~5 minutes for the "Oxygen 4.8.3+ requires a migration of your Oxygen meta keys" admin notice to go away. If it doesn't go away on its own, proceed to:
  • Go to WP Admin > Oxygen > Settings > Tools and click Migrate Meta
  • Clear your cache with your server / host / cache plugin

Oxygen 4.8.3 is a security update that addresses a vulnerability reported to us by security researcher Francesco Carlucci. It also includes a fix for broken Gutenberg blocks in the latest version of WordPress (6.5+) when using Oxygen.

The security issue we have addressed is a privilege escalation vulnerability that would allow a user with “contributor” or higher permissions to escalate their privileges to an admin (CVE-2024-4662). This issue impacts anyone that has granted untrusted users Contributor+ access to their WordPress website. It does not affect you if you do not have Contributor+ users on your WordPress website. This issue can only be exploited by a Contributor+ user.

At this time there are no known instances of this vulnerability being exploited in the wild.

How To Know If You Are Impacted

If there are no non-admin users on your website with a role of Contributor or higher, you are not vulnerable.

If you granted non-admin users on your site a role of Contributor or higher, you are impacted. You should upgrade to 4.8.3.

Updating To 4.8.3

After installing 4.8.3, your site will attempt to automatically perform a migration step. In most cases, this will be a seamless process and your site will experience no downtime.

Possible issues you may experience if the migration fails are: some or all of your site going blank on the front-end, or appearing blank when you open Oxygen to edit some content.

If your site experiences issues after the update, here’s what you need to do:

  1. For large sites, wait ~5 minutes for the "Oxygen 4.8.3+ requires a migration of your Oxygen meta keys" admin notice to go away. If it doesn't go away on its own, proceed to:
  2. Go to Oxygen > Settings > Tools in the WordPress admin panel
  3. Click the “Migrate Meta” button

If you continue to experience issues after following these steps, the issue is unlikely to be related to 4.8.3. Please email and our team will be happy to help.

Downgrading to Previous Versions

If, for some reason, you need to downgrade to a version prior to 4.8.3, you will need to reverse the meta migration.

This can be done under Oxygen > Settings > Tools by clicking the “Undo Migrate Meta” button.

Once the migration has been reversed, you can then install Oxygen 4.8.2 or earlier. Don’t forget to clear all caches.

Oxygen Gutenberg Integration 1.4.5

We're also releasing version 1.4.5 of the Oxygen Gutenberg integration, which is required to support the new meta keys in Oxygen 4.8.3.

Please make sure you're using the appropriate version of the Gutenberg integration based on which version of Oxygen you're using: Oxygen 4.8.3 requires Oxygen Gutenberg 1.4.5 or later. Oxygen <= 4.8.2 requires Oxygen Gutenberg 1.4.4.

Other Notes

Once Francesco reported a similar issue to us for Breakdance, we invited them to investigate Oxygen as well. On May 7th, they alerted us to this vulnerability in Oxygen and we immediately began work to remediate the issue.

This reiterates the importance of regular, high quality security audits, a long-time standard practice here at Soflyy. Please note that any reports about this issue coming out through Patchstack are from other security researchers attempting to replicate the Breakdance RCE in Oxygen, and that the discovery should be credited to Francesco Carlucci who validated CVE-2024-4662 on May 8th via WordFence.

Leave a Reply

Your email address will not be published. Required fields are marked *

Get Oxygen Today

Lifetime, unlimited site license

Copyright © 2024 Soflyy
linkedin facebook pinterest youtube rss twitter instagram facebook-blank rss-blank linkedin-blank pinterest youtube twitter instagram