2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges.? If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended. The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch.? The second problem, discovered by Dawid Golunski, is an issue…
As you know over the past couple of months we have been working on the new features for WordPress 2.9. We have also been working on trying to make WordPress as secure as possible and during this process we have identified a number of security hardening changes that we thought were worth back-porting to the…
A stitch in time saves nine. I couldn’t sew my way out of a bag, but it’s true advice for bloggers as well — a little bit of work on an upgrade now saves a lot of work fixing something later. Right now there is a worm making its way around old, unpatched versions of…
Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password…
Unfortunately, I missed some places when fixing the privilege escalation issues for 2.8.1.? Luckily, the entire WordPress community has our backs.? Several folks in the community dug deeper and discovered areas that were overlooked.? With their help, the remaining issues are fixed in 2.8.3.? Since this is a security release, upgrading is highly recommended.? Download…
The WordPress team had initially committed to maintaining the WordPress 2.0.x legacy branch until 2010. Unfortunately, we bit off more than we could chew—the 2.0.x branch is now retired and deprecated, a few months shy of 2010. Many of the security improvements to the new versions of WordPress in the last couple of years were…
Stefan Esser recently warned developers of the dangers of SQL Column Truncation and the weakness of mt_rand().? With his help we worked around these problems and are now releasing WordPress 2.6.2.? If you allow open registration on your blog, you should definitely upgrade.? With open registration enabled, it is possible in WordPress versions 2.6.1 and…
We have a security update release now available for both the 2.1 and 2.0 branches of WordPress now available for immediate download. This update is highly recommend for all users of both branches. These releases include fixes for several publicly known minor XSS issues, one major XML-RPC issue, and a proactive full sweep of the…
Recently a bug in certain versions of PHP came to our attention that could cause a security vulnerability in your blog. We’re able to work around it fairly easily, so we’ve decided to release 2.0.7 to fix the PHP security problem and the Feedburner issue that was in 2.0.6. It is recommended that everyone running…
We have a pretty important release available for everyone, it includes an important security fix and it’s recommended that everyone upgrade. This is the latest release in our stable 2.0 line, which we’ve committed to maintaining for several more years. Here’s what’s new: The aforementioned security fixes. HTML quicktags now work in Safari browsers. Comments…