Title: Version 4.9.30
Author: Lance Willett
Published: August 6, 2026

---

# Version 4.9.30

## In this article

 * [Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#installation-update-information)
 * [Summary](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#summary)
    - [Security updates](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#security-updates)
 * [Change log](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#change-log)
    - [List of files revised](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#list-of-files-revised)
    - [List of packages revised](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#list-of-packages-revised)

[ Back to top](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#wp--skip-link--target)

On August 6, 2026, WordPress 4.9.30 was released to the public.

## 󠀁[Installation/Update Information](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#installation-update-information)󠁿

To get this version, update automatically from the Dashboard > Updates menu in your
site’s admin area or visit [https://wordpress.org/download/releases/](https://wordpress.org/download/releases/).

For step-by-step instructions on installing and updating WordPress:

 * [Updating WordPress](https://wordpress.org/documentation/article/updating-wordpress/)

If you are new to WordPress, we recommend that you begin with the following:

 * [Get Started With WordPress](https://wordpress.org/documentation/article/get-started-with-wordpress/)
 * [First Steps With WordPress](https://wordpress.org/documentation/article/first-steps-with-wordpress-classic/)
   or [Upgrading WordPress Extended](https://developer.wordpress.org/advanced-administration/upgrade/upgrading/)
 * [WordPress Courses](https://learn.wordpress.org/courses/)

## 󠀁[Summary](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#summary)󠁿

### 󠀁[Security updates](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#security-updates)󠁿

This release features several security fixes. Because this is a security release,**
it is recommended that you update your sites immediately.**
The security team would
like to thank the following people for [responsibly reporting vulnerabilities](https://hackerone.com/wordpress?type=team),
and allowing them to be fixed in this release:

 * A bypass of the email address confirmation flow reported by 0ways
 * An Author+ CSS injection issue via a bypass of the safe CSS attribute filter 
   reported by Anthropic
 * A privilege escalation issue on multisite networks with user registration enabled,
   allowing a user to create a new site reported by Aikido Security
 * A server-side request forgery (SSRF) issue in URL validation allowing requests
   to link-local ranges reported by Andrew Mohawk and multiple independent reporters
 * A pre-auth reflected cross-site scripting (XSS) issue on the login screen with
   potential to lead to PHP code execution reported by the team at pwn.ai
 * An enumeration of post slugs reported by HDWSec
 * A Contributor+ stored cross-site scripting (XSS) issue in Quick Edit on sites
   with a large number of users reported by Naveen S and Ajmal Moochingal

## 󠀁[Change log](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#change-log)󠁿

### 󠀁[List of files revised](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#list-of-files-revised)󠁿

    ```wp-block-preformatted
    /wp-admin/includes/user.php/wp-admin/js/inline-edit-post.js/wp-includes/canonical.php/wp-includes/http.php/wp-includes/kses.php/wp-includes/user.php/wp-signup.php
    ```

### 󠀁[List of packages revised](https://wordpress.org/documentation/wordpress-version/version-4-9-30/?output_format=md#list-of-packages-revised)󠁿

No package was revised.

First published

August 6, 2026

Last updated