Textpattern CMS 4.9.2 (2 Nov) fixes nine security issues, including an arbitrary file write through XML-RPC, CSRF in theme import and an admin-rights check on the Users panel; all earlier versions affected
The Textpattern CMS project released Textpattern 4.9.2 on 2 November 2026 as a patch release with security fixes, and says versions before 4.9.2 are affected unless stated.
The issues, reported by third-party researchers, are: an authentication issue with concurrent logins and cookies; content sandboxing of preview frames (with a new admin-side Content Security Policy layer); unsanitised 'sort' attributes in the authors and file_download tags; inconsistent sanitising of the 'url_title' attribute; a user-privilege cross-site request forgery mitigated with CSP; cross-site request forgery in the theme import workflow; missing validation of administrative user status on the Users panel; and an arbitrary file write through XML-RPC, which the project links to CVE-2026-5344.
The project gives no severity ratings and says it will update the post with CVE assignments. (source: Textpattern)
- Product
- Textpattern CMS (open-source PHP content management system)
- Versions
- Affected: Textpattern before 4.9.2 (unless stated); fixed: 4.9.2 (2 Nov 2026). CVE named by the project: CVE-2026-5344 (XML-RPC arbitrary file write).
- Exploited in Australia?
- unknown
- Patch to
- Back up site files and the database, then upgrade to Textpattern 4.9.2 using UPGRADE.txt.