FYI. WordPress 4.9.7 was released today, July 5, 2018.
From WordPress.org.
WordPress 4.9.7 is now available. This is a security and maintenance release for all versions since WordPress 3.7. We strongly encourage you to update your sites immediately.
WordPress versions 4.9.6 and earlier are affected by a media issue that could potentially allow a user with certain capabilities to attempt to delete files outside the uploads directory.
https://wordpress.org/news/2018/07/wordpress-4-9-7-security-and-maintenance-release/