WordPress Security: Critical 0-Day Upgrade Released Today for 2.2 and 2.0.

Upgrade Wordpress Right Away

WordPress released upgrades today to both the 2.2 development path ( WordPress 2.2.2 ) and the 2.0 legacy path ( WordPress 2.0.11 ).

Both of these releases contain some important security fixes, so you really need to get your WordPress installation upgraded.

Read the Upgrade Release Notice, and Download the New Version appropriate to your chosen actively maintained path.

I want to take a minute to point out something I think is very important that you understand.

There are a number of people out there telling people that they are Okay as long as they are using the latest version in their path. This is being put out most frequently by people using and recommending version 2.1.3. I'm not naming any names or calling out any one individual. I've heard this argument from a handful of people, and most of them I actually respect. They aren't being malicious, they are simply mistaken.

Consider this direct quote from the WordPress Release Archive.

None of these are safe to use, except the latest in the 2.0 or 2.2 series, which are both actively maintained.

Does anything in that quote make you feel all warm and fuzzy about running a 2.1.3 install? I can tell you that when I got hacked that's the version I was running, and the vulnerabilities are still there. Knowing is only half the battle though. I strongly encourage you to get onto an upgrade path that is in current development.

Notes About The Update

IT Damager points out that "every single update to WordPress over the last 2 years has been security related", and calls for the WordPress community to demand better security coding practices from the developers. He also points out that if you are running a WPMU blog network, you are giving all of your users access to admin accounts, and that WPMU has not been updated.

mybeNi has posted 7 zero-day cross site scripting vulnerabilities that todays upgrade fixes. These can be some nasty stuff and could cost you your whole blog if you ignore them.

Beginners Guide to Upgrading WordPress?

I have previously written a WordPress installation guide for beginners. I did this because some of the instructions seemed a little vague for beginners.

I fully intended to take this opportunity to write another guide for beginners on the upgrade process. As I was preparing to write it, however, I took a look at the xtended instructions on upgrading at WordPress.org and I really had second thoughts about just how needed such a guide would be. I know a few people have asked me to write one, but I think the resource that is already there does the job pretty well. The only thing missing is the screen shots, and perhaps a discussion of putting your site into a maintenance mode while you delete and upload the files.

Let me know what you think. Check out the guide there, and if anyone still thinks they need even more basic steps, let me know and I'll go ahead and write it.