Secure Wordpress with the first Wordpress Worm - gHacks Tech News

Secure WordPress with the first WordPress Worm

Did you know that the latest version of WordPress contains at least seven security vulnerabilities that could compromise your blog? If you use WordPress you should make sure that to fix them as soon as possible. The easiest way to fix them right now is to use the first WordPress worm -  a good one - as it fixes all seven vulnerabilities on affected websites.

The process requires faith that the xss worm is really fixing the vulnerabilities but the use is actually very easy. About faith: I have not read negative reviews so far and the worm has been released two days ago which should be enough time for some experts to complain about it.

If you want to secure your blog you simply write a comment on your own blog while you are logged in as the administrator linking to http://mybeni.rootzilla.de/mybeNi/ ; Click on that link from your admin panel afterwards which will lead to the site.

The first page explains what will be done and only if you actively click on "Secure my Blog" the vulnerability scan will be started. It will check three WordPress files for the vulnerabilities and offer to fix them if the vulnerability is found.

The vulnerabilities can only be fixed if the files are writable so make sure they are. An alternative would be to copy the code that will be inserted and add it manually in the files. The complete code of the file is shown and the addition is highlighted.

I suggest to run the worm a second time to make sure that your blog is safe and that the fixes have been applied.

Update: It is no longer necessary to do so as WordPress has resolved all the vulnerabilities in newer versions. There are however a couple of things you can do to protect your WordPress blog. Among the options are to enable two-factor authentication which protects accounts with a second layer of protection.





  • We need your help

    Advertising revenue is falling fast across the Internet, and independently-run sites like Ghacks are hit hardest by it. The advertising model in its current form is coming to an end, and we have to find other ways to continue operating this site.

    We are committed to keeping our content free and independent, which means no paywalls, no sponsored posts, no annoying ad formats (video ads) or subscription fees.

    If you like our content, and would like to help, please consider making a contribution:

    Comments

    1. Ryan Wagner said on August 2, 2007 at 7:31 pm
      Reply

      I’m surprised WordPress doesn’t put out a plug-in that can fix these issues in one click.

    2. Tris Hussey said on August 2, 2007 at 7:32 pm
      Reply

      Hey Martin I e-mailed this over to one of my friends who is a core WP developer (as in he can commit code to WP core … he’s that good) … he suggests NOT using this patch/worm. There will be an update soon to fix the most serious of the flaws, and you can get it now via the WP SVN repository.
      http://svn.automattic.com/wordpress/branches/2.2/

      Well meaning, I know, but maybe the best thing is for people to submit fixes to WP.org instead.

    3. Martin said on August 2, 2007 at 7:40 pm
      Reply

      Tris I think the author mentioned that he submitted the vulnerabilities to WordPress and that most of them will be fixed in the next update.

      Relying on files that are officially published by WordPress is of course always better than a third party fix.. well, most of the time.

      Did he mention which vulnerabilities they do not fix ?

    4. Tris Hussey said on August 3, 2007 at 3:49 am
      Reply
    5. Alter Falter! said on August 3, 2007 at 10:38 am
      Reply

      Trusting a worm to “fix” my WordPress? Well, maybe later. After sueing myself for downloading illegal stuff from the internet.

      :)

    6. dhan said on April 1, 2010 at 9:58 am
      Reply

      How it can be work? I want to use it for my blog

    Leave a Reply