WordPress 3.4.2 Maintenance and Security Release arrived today, and it’s time to update.
This is both a maintenance and security release, therefore it is mandatory, not optional.
Recently, I wrote about keeping WordPress updated for security reasons, and I’m singing the same song again.
Don’t wait. Don’t hesitate. Use the automatic, one-click update feature.
In less than 30 seconds (for most sites), your WordPress site will be updated and protected from most security issues (can’t help the idiots with dumb passwords and untrustworthy associates). Until these types of updates are automatic, seamless, and invisible, and they are getting close to needing to be, take 30 seconds and save yourself hours if not days of hair-pulling stress and costly unpaid hours of labor and wishing you’d spent 30 seconds.
If you think that I’m just making noise, check out this list of WordPress Security Threats for august 2012, which includes issues with WordPress Plugins mostly, and great links to discussions on WordPress security such as the recent presentation of WordPress Security – Cutting Through The BS by Toni Perez of Sucuri at WordCamp Chicago.
NOTE: For those having issues with Custom Fields in WordPress, there is a known bug in 3.4.2 with custom fields and this WordPress Plugin has the hotfix to rsolve the issue.
Via Feedburner
Subscribe by Email
Lorelle on WordPress 
43 Comments
Thanks Lorelle!
Timely, as always! Today I had my 2nd pfishing attack on a WP 3.4.1 website, so your tips are very timely.
The Sucuri scanner sitecheck was great in confirming I had managed to get rid of the rot.
Regards, Peter
I’m glad that you were able to update in a timely way. How did you know you had a phishing attack?
I don’t agree with automatic updates.
I used to use Firefox fully, I switched to Chrome. With Firefox you have to restart the bloody browser everytime you update. Chrome does it automatically which is good.
However I don’t like WordPress to update itself. I have a few elements on my files that I hard-coded them instead of using a plugin.
An update of the header file would eliminate one of my site’s plugins (or any file that I have custom code into it).
I want to choose when I update. I tend to update within 12 hours of an update coming during regular business hours, 24 hours if I am sleeping time when it comes. 48-72 hours if I am travelling.
I agree, updates shouldn’t be automatic. If you want automatic upgrades, choose a web host like WPEngine and let them manage your installation for you. Otherwise, leave the updating to me.
This, however, does create a problem — for sites that have owners where the installation never gets updated. Not everyone is as prudent as you or I, updating within 12 hours.
Maybe a setting would be useful, automatic or manual updates — so a site owner could leave their site to auto-update and remain safe from hackers.
I agree that automatic updates should be optional. It’s a tough day when there is an update and I have to go through all my clients’ sites to update. They are diverse enough that I don’t want to hook them up with a single update service, so I take times and run through them all. It isn’t a bid deal, and I’ve been teaching most of them to update themselves, but there are “those clients” nervous about it so I do it for them. Having it be optional for those who don’t pay attention or get freaked out over an update would be awesome. For people like Miroslav, he would turn that off and do it manually. Everyone happy.
@Miroslav: Trust you to do things the hard way. Firefox 15 now updates in the background. Chrome updates all the time without your permission. It has been the policy of all of WordPress to NOT touch core files but use WordPress Plugins to change them, making upgrading easy. Why not put the custom code in the header file in an include or Plugin or in the functions.php? Why make life painful for you when WordPress is working so hard to update.
Thanks for the reminder, Lorelle, and for the links to the info on WordPress security. I don’t keep up with WordPress security as well as I should. Those articles are an eye-opener.
I’m taking time to update my blogs now. Scary stuff.
Has WordPress updated itself or do I have to do something?
We’re not talking about WordPress.com … This update is for the self-hosted version which is available at WordPress.org website.
Thanks for this info
@Bill: As stated in the article, if you are on WordPress.com, which you are, you need to sit back and enjoy the security. Do nothing but blog.
why cant i get to any of my admin pages on my site after the 3.4.2 update?
Same thing happened to me. Have tried the update three times, deactivated plugins, taken the other recommended updating precautions. Each time I was locked out of my administrative pages, though site viewed normally to users. Just reinstalled site from backup after third attempt this morning and am seeing the issue popping up on other troubleshooting sites. This is the first time I have had problems with an update, so stumped on this one.
Thanks so much Lorelle! Updated all the sites now!
Try re-installing the WordPress files via FTP, a fresh install may help.
Otherwise, try disabling all plugins and switch back to the default theme.
Or try clearing your cache in your browser. There weren’t any serious functional changes between 3.4.1 -> 3.4.2, minor bug fixes and a few security fixes.
I understand that 3.4.2 will make my blog secure. However, there seems to be an issue with the Custom Keys as I updated to the latest version. I have like 4 custom keys setup. Whenever I add a new article, I add the value for those 4 custom keys. Earlier, I could add all 4 keys one after the other. However, now when I add one, the “Add Custom Key” button just disappears. I have to hit the Save As Draft button after adding each key. Every time I reload the article, the Add Custom Key button re-appears.
This is not the case with just one of my blogs, same problem with my other 2 blogs. I don’t think this has anything to do with the type of theme or plugins I’m using. It seems to be a bug in the 3.4.2 update.
Anyone else using custom keys?
@Duff: Check with the WordPress Plugin author for an update, or Theme or whatever Custom Keys is. Go to the author.
Custom Fields is a very neat and clean way to add stuff to your posts. It is THE MOST AMAZING way to add extra code to your posts without the use of any plugins or without making additions to the core files. It is kind of hook system. I love WordPress just because of the amazing Custom Fields: http://codex.wordpress.org/Custom_Fields
But with this new update, Custom Fields button is playing nuts on me. Everytime I add the value for a custom field and hit Add Custom Field button .. it disappears! And, I have no clue how to fix it 😦
I am very familiar with Custom Fields, not Custom Keys. Have you seen the hot fix mentioned in this WordPress Support Forum post?
“This is both a maintenance and security release, therefore it is mandatory, not optional.”
Thanks for the heads up Lorelle much appreciated.
Still confounded. Reinstalled the update and upgraded manually. That didn’t work so I re-installed WordPress Twenty Eleven and tried upgrade again. Same result. Site sans plugins looks normal, but no administrative access. W3 cache plugin was disabled, but renamed its files anyway. No change. Finally restored site from a backup for the fourth time, and sent another email to hosting provider, who cannot see any issues. Out of ideas.
what about add costum fields error? I try some themes such as twentyten at wordpress 3.4.2.
custom fields exists but when i try to fill NAME and VALUE and then pressed the button ADD CUSTOM FIELD, no reaction
CUSTOM FIELD ADD button it disappears,i mean..
If you are getting custom field errors, check with the developer of the Plugin or Theme for the updated version.
Lorelle, Custom Fields (or Custom Keys) has nothing to do with plugins or themes. It is a built-in functionality provided by the WordPress team. It is a part of the core files and the new update messed it up waaaaaa 😥
Fixed. Copied the wp-admin folder from new download of WordPress, overwrote the old folder, and dashboard and admin functions returned. Not sure why re-installing WordPress didn’t do the same thing, but for anyone having this problem it is worth a try.
@Bob: Thanks for the update on how you fixed this, which is the same method I would have recommended. If you are updating manually, or on an unstable Internet connection, files can get wonky during transfer. This isn’t so much a WordPress issue as it is a transfer issue. Good for you!
I must be MORE stupid than I originally thought. When someone tells me that a one-click 30 second update will do it I believe it. Not on my Mac. I automatically update all my stuff on my Mac mainly because of security and it really is one click and it carries on doing it in the background while I keep working.
I have just spent 30 minutes trying to find ‘Updates’ in my ‘Site Admin’ in my Dashboard! All as instructed, I can’t find Site Admin in Dashboard. I can’t find Updates in Dashboard. So I went to Download now on the .org site and it then started telling me that I need to back up my database, I may lose some files. Blah. Blah. Sorry but I am not a technician, it it ain’t idiot proof I won’t find it.
But thanks for the warning anyway!
Regards
Mark
@Mark, according to your comment form’s website address, you are on WordPress.com. As stated in the comments and in the article, if you are on WordPress.com, sit back and relax. It is all taken care of for you. No worries.
Told you I was Stupid!!
Thank you. x
Just remember, stupid is as stupid does. 😀 Don’t think you are stupid, just not paying attention to details. LOL!
Actually, there is a lot of confusion between WordPress.com and the self-hosted version of WordPress.
Thanks :-0))
I always hit the update button. I love how easy it is to update now. It makes things so much faster and smoother.
Yeah that little cute UPDATE NOW button is so tempting. Hope you are making a backup of the database before you hit it 🙂
I had my lesson on the last update but I was lucky that I had created a backup just couple of days ago. You never know what can happen when you hit that little cute Update Now button ..
Lorelle,
I so love to look at the code of EVERY plugin I install, even if I uninstall/delete them later on and go for another one. I rip every character of code up and look how it works.
On the automatic update thing…I think people are becoming lazy now a days. If everything about WordPress was automatic then a lot of WP techies would be out of a job. A few lines of code that do the automatic things would be a lot cheaper than you or I or any other human.
Such an interesting way to frame it: saving yourself in the future by spending 30 seconds now. So simple. So true. I always update WordPress as soon as the updates come out. Absolutely love it!
Thanks for informational have tried the update three times, deactivated plugins, taken the other recommended updating precautions. Each time I was locked out of my administrative pages, though site viewed normally to users. Just reinstalled site from backup after third attempt this morning and am seeing the issue popping up on other troubleshooting sites. This is the first time I have had problems with an update, so stumped on this one.
@Derricks: Check in on the forum. Do a manual update. I bet there is an issue with Plugins or something in the uploading process. This kind of situation is very rare and usually the result of a non-standard installation or a server issue. Check to make sure all the cache is cleared and turned off.
I’d love to just upgrade, BUT unfortunately, my primary blog (self hosted), has a small number of plugins that are not listed as being compatible with the new version.
So, I need a bigger chunk of time than just the 30 seconds to ‘do the update’. I need time to backup the system, try the upgrade, see what breaks, fix it all… And if some plugins really don’t work, then I need to find a substitute plugin, and modify to work with the new plug in.
I need to block out a couple hours for this. Perhaps this weekend.
I understand why others with less technical ability, or larger sites with more plugins and customizations delay even longer before doing their upgrade.
@Jesse:
It is likely that the Plugins you are using will not be impacted by the update. If they are, I highly recommend you make time sooner rather than later. The odds are that there will be no issue when you upgrade. The time spent fixing the site after a hack will be infinitely greater than the few minutes it will take to check Plugins. Be careful.
I’ve been having some trouble with my site after this update. This is a bit unusual, but I was able to log in and make a post with no troubles, and when finished, I completed the update. I went back to log into the site and it wouldn’t let me. The fields go blank after I hit enter and it stays on the log in screen. I’ve been through tech support with my host for over a week now to resolve this, and prior to that, I used the WordPress forum. Nothing is working. Everyone keeps saying to reset my password manually, but even the tech support people have gone in to try that and nothing works. This is only happening since I did this update. Could it be possible that my theme wasn’t compatible with the update? My website still shows up, but this is getting really aggravating. I don’t even know if wiping everything and starting over would even solve the issue.
Sounds like a WordPress Plugin. Turn them off and it should work fine, per instructions mentioned here.
I can’t get into my dashboard to turn them off. I’ve tried to follow instructions on the WordPress forum to reach plugins through my ftp host, but don’t see the options once there. Is there a specific link or thread I need to be looking at for this? Thanks 🙂
To disable Plugins via ftp, rename the Plugins folder. That’s it. Rename it back once you’ve logged in and checked it is working. Do the same for Themes if you think that is the issue.
One Trackback/Pingback
הזעת יתר בבית השחי בוטוקס…
… בוטוקס השוואת מחירים – אך לאחרונה חלו תמורות נוספות בתחום שמאפשרות מתן מענה גם לקמטים עמוקים. הרעלן גורם למחלת הבוטוליזם ופעולתו הקטלנית על השרירים, הקטנים המעורבים ביצירת הקמט. בשנים האחרונות החלה נפ… Update WordPress Now: WordPress 3.4.2 Releas…