Comments on: So now you understand the importance of Upgrading WordPress?

By: Justin Palmer

Justin Palmer — Mon, 07 Sep 2009 03:48:31 +0000

Wow, what luck I stumbled on this today. I just noticed that my wordpress permalinks had changed, and couldn’t for the life of me figure out what happened.

So yes, I must be one of the lazy bloggers who doesn’t upgrade their platform enough :)

By: Alex

Alex — Sun, 06 Sep 2009 22:10:25 +0000

Re Corsin’s suggestion, I’ve made ismyblogworking.com detect this exploit and several others. If you subscribe to the RSS feed there for your blog(s) you’ll get an update if your blog is compromised by one of them. It’ll also warn you to update if your copy of WordPress is out of date (cough cough).

By: Allen

Allen — Sun, 06 Sep 2009 13:55:58 +0000

Thanks for the links! This whole exploit blowup has been interesting to watch. I’ve been hit so many times over the last 3 months that I should become a hacker :)

By: Corsin

Corsin — Sun, 06 Sep 2009 13:53:01 +0000

hi mayank
I hope my plugins are safe :) at least they should.
My thought goes more in the direction of what happens, once WordPress only allows to install verified/certified plugins. I do not think somebody wants to certify my plugin that creates a database connection and returns a random joke :-)

By: mayank

mayank — Sun, 06 Sep 2009 13:21:40 +0000

@corsin – thanks for dropping by and keeping the discussion going on :) As far as the plugins that one has developed for his/her blog will mean that they already know the plugin is safe to use and that it will not be malicious. Other than that, it will be good if WordPress will certify the plugins – that process will encourage plugin developers to get their plugins certified from them as it will give assurance to the plugin users that they are using a safe plugin and that it’s not malicious. This process will take time, eventually it will become part of the system.. isn’t it :)

By: Corsin

Corsin — Sun, 06 Sep 2009 10:50:54 +0000

Thanks for linking to me and keeping the discussion alive.
I have discussed with Allen yesterday a little bit about the whole incident. And as much as I like the idea to certify plugins, I wonder what happen to all the plugins I wrote for just one of my blogs? If WordPress allows to install un-certified plugins, the system is broken already. And if they do not allow that, my plugins are useless. It is going to be hard to have a balance between the two.