WordPress has published a new version of its popular open-source blogging platform to address multiple security bugs. Version 3.0.2 of the software corrects a loophole that creates a means for ordinary authors to gain admin-level privileges on a site, among a slew of other bugs.
The update also removes a "pingback/trackback blogroll whitelisting feature as it can easily be abused". The vulns might sound comparatively moderate when taken individually, but developers of WordPress described the update as "mandatory" in a detailed advisory.
Bugs in WordPress have been used to spread worms or post fake messages under the assumed names of a website's owner in the past.
The latest set of security holes probably don't allow anything that bad, even if used in combination with other website flaws, but still ought to be addressed sooner rather than later. [Date: 2 December 2010; Source: http://www.theregister.co.uk/2010/12/02/wordpress_blogging_update/]
No comments:
Post a Comment