Ok.. So finally Kim did post about my exploit…. (our communication on the subject has been via email so far). I’m not too sure if it should be termed a “hack” though, just because if the intention was to hack, I could have very …

Bei der beliebten Blogsoftware Wordpress gibt es mit der Version 2.0.4 diverse kritische Lücken gestopft und insgesamt 50 Bugs behoben. Das Update sollte so schnell wie möglich eingespielt werden.

…

http://trac.wordpress.org/log/branches/2.0?action=stop_on_copy&rev=4066&stop_rev=3826&mode=stop_on_copy

Does NOT include the security fix though does it? I would guess no way!! ???

Trust me, I am the first one annoyed by this (considering how some of my blogs still happily run 1.5 with little will to upgrade), but it is now time to seriously consider upgrading.

I wished there was a better way, especially considering WP 2.0 comes with its own bunch of issues, bugs and security issues, but it will become increasingly tedious to keep up with all the security fixes and provides 1.5-compatible patches for them. Chiefly thanks to the aforementioned level of transparency and communication around these flaws: it takes skills worthy of a 70’s Eastern European spy to manage and extort clear information from the Powers That Be on every single security flaw that may affect each version of Wordpress.

I for one, will keep user reg disabled on my 1.5 blogs, quickly tweak the most critical bits and look into upgrading to an easier-to-maintain platform (be it WP or other) soon enough. I advise you do the same or your life will be a kafkaesque hell of muddy bug report decrypting and patch maintenance.

The exploit has been, as far as I can tell(*), fixed by the latest 2.0.4 release. You are therefore strongly recommended to (read: you MUST) upgrade to this version.

As for the “users can register” option: enabling it back should be OK.
I personally will leave it off on my blogs, as I just don’t feel like entrusting strangers with access to wp-admin in the current state of the code (I insist that the aforementioned exploit has been fixed now, I am only being paranoid here).

(*) Note that this is only my own very superficial testing of the code released: in no way the word of any official developer. You should all be aware that I have barely any more official knowledge of this than you do, considering Matt’s fondness for the stealth&ignore school of crisis management (basically, if i doesn’t make it on Slashdot, you can bet you’ll never read about it on his blog). As you may have noticed, he has been marvellously low-key about the whole thing (you know, don’t want investors users to “panic” or, god forbid, start suspecting that WP might sometimes have security flaws in it). It also bears pointing out that he has neither contacted me nor replied to my emails in any way other than posting his very helpful comment above.

And just to definitely close that chapter of WP’s Incredible Security Adventures by saying I have no regrets whatsoever about releasing this warning, given the way it was otherwise handled by WP officials: 1) deny 2) minimize 3) somewhat acknowledge 4) keep shut 5) release an upgrade that likely won’t be installed by more than 50% of the general public with for only communication a tiny confusing “upgrade announcement” message in the dashboard feed, wedged between two inconsequential WP marketoid news.

But obviously only Dr D can say for sure. None of those security fixes seemed like a non priv user exploit. My guess is it was not since 2.0.4 was hitting beta just as Dr D sent his announcement. Just a guess.

thanks for the advise!

Have you tried to submit this issue to SECURITYFOCUS or any other CERT? Probably that will propagate it much faster and better.

Ignacio.

Dr. Dave, the dude behind Spam Karma, has issued a warning to all WordPress users. A message popped up on my Spam Karma 2 dashboard warning of a potential security vulnerability in WordPress. Here’s part of the warning:
If you are running Wordp…

Laut Dr. Dave und anderen kann es in allen WordPress Versionen ein Sicherheitsproblem geben, wenn Benutzern das Registrieren erlaubt ist.
Es wird dringend empfohlen das Registrieren für Gäste abzuschalten und sämtliche unbekannte Gast-…