WordPress 4.9.7 update fixes a vulnerability

WordPress 4.9.7 update fixes a vulnerability that allowed a registered user with certain privileges to delete an arbitrary file via a path substitution in the media manager.

We update promptly.

https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/