Wordpress 2.3.3 Security Release

A new version of Wordpress has been released just a few hours ago by the Wordpress team. The update is considered critical and fixes a security vulnerability and some minor bugs. The security flaw was found in the implementation of the XML-RPC which would allow any registered user to edit comments of other users using a specially crafted request.

Webmasters have two choices on how to secure and update their blog. The first is to use the official update process described on the Wordpress homepage which involves downloading the full distribution and replace the old files with it. A faster way which webmasters with a lot of blogs will probably prefer is to replace the xmlrpc.php with the updated one which will fix the security vulnerability but leave the minor bugs in place.

That’s probably the better solution if you never encountered them. The bugs will automatically be fixed with the next big release of Wordpress. Just make sure you update at least the security vulnerability in xmlrpc.php.

• Reddit
• StumbleUpon
• Delicious
• Digg
• Twitter

Tags: wordpress, wordpress update
Categories: Online Services, The Web

Related posts:

5 Responses to “Wordpress 2.3.3 Security Release”

1. Tysen says:

   February 5, 2008 at 3:33 pm

   The security flaw is described as “a specially crafted request would allow any valid user to edit posts of any other user on that blog.” What if you only have one user registered for a blog? Is it still a major security concern?

Trackbacks/Pingbacks

1. Wordpress 2.3.3 Security Release | Tech Tips says:

   February 5, 2008 at 12:48 pm

   [...] Wordpress 2.3.3 Security Release [...]
2. WordPreess 2.3.3 listo para descarga… corrige una vulnerabilidad crítica : says:

   February 5, 2008 at 1:57 pm

   [...] problema de seguridad fue encontrada en la aplicación del XML-RPC que permita a cualquier usuario registrado para editar los comentarios de otros usuarios mediante [...]
3. El Mundo de Faralai » Ha sido lanzada una nueva versión de Wordpress (2.2.3)… says:

   February 5, 2008 at 3:16 pm

   [...] problema de seguridad fue encontrada en la aplicación del XML-RPC que permita a cualquier usuario registrado para editar los comentarios de otros usuarios mediante [...]
4. WordPress 2.3.3 listo para descarga… corrige una vulnerabilidad crítica : says:

   February 5, 2008 at 5:39 pm

   [...] problema de seguridad fue encontrada en la aplicación del XML-RPC que permita a cualquier usuario registrado para editar los comentarios de otros usuarios mediante [...]