WP REST API Critical Security Release ![rw-book-cover](https://s.w.org/images/backgrounds/wordpress-bg-medblue.png) ## Metadata - Author: [[Make WordPress Core]] - Full Title: WP REST API Critical Security Release - Category: #articles - Summary: WP REST API plugin version 1.2.1 is now available as a critical security release. This release fixes a serious information disclosure vulnerability, which allowed for unpublished content and post revisions to be retrieved via the REST API. All previous versions of the plugin are affected. - URL: https://make.wordpress.org/core/2015/04/09/wp-rest-api-critical-security-release/ WP REST API plugin version 1.2.1 is now available as a critical security release. This release fixes a serious information disclosure vulnerability, which allowed for unpublished content and post revisions to be retrieved via the REST API. **All previous versions of the plugin are affected. All WP REST API users are strongly encouraged to update immediately.** Update with one click from Dashboard → Updates, get it from [the plugin directory](https://wordpress.org/plugins/json-rest-api/) ([zip](https://downloads.wordpress.org/plugin/json-rest-api.latest-stable.zip)), or pull it [from GitHub](https://github.com/WP-API/WP-API/tags). This release was coordinated by the REST API team and the WordPress core security team. The security team is pushing [automatic updates](https://make.wordpress.org/plugins/2015/03/14/plugin-automatic-security-updates/) for this plugin. Each branch was separately patched; there are packages for 1.2.1, 1.1.3, 1.0.2, 0.9.2, and 0.8.2. If you believe you have discovered a potential security vulnerability with the WP REST API, please disclose it to us privately by sending an email to [[email protected]](mailto:[email protected]). Security issues can also be reported via [HackerOne](https://hackerone.com/wp-api). If you have a question about the release, you can find the team in [#core-restapi](https://make.wordpress.org/core/tag/core-restapi/) on [WordPress.org Slack](https://chat.wordpress.org/), or you can privately message [@rachelbaker](https://profiles.wordpress.org/rachelbaker/), [@danielbachhuber](https://profiles.wordpress.org/danielbachhuber/), or [@joehoyle](https://profiles.wordpress.org/joehoyle/)., WP REST API Critical Security Release, Make WordPress Core, 01gnmcz6bzkw3q44datb8c3fcv.