Wordpress users beware! [Vulnerability]

[Ecchi22]

There's new Wordpress exploit out there that can be dangerous..

Affected version is the newest one (2.6.1) and it works only if you have enabled user registration option.. It is disabled by default, so if you don't know what it is, relax.. But if you have it turned on, I'd recommend you to disable it for now, until someone post solution to this.

Attacker can change the Administrator password (but the real admin will receive the new password on his e-mail, so you'll notice it for sure)

Source: http://www.milw0rm.com/exploits/6397

[Ecchi22]

If you wanna check if your blog have registration enabled just go to yourblog.com/wp-login.php?action=register

[Aussie Rebel]

thanks and bump

[klaze]

my enemie's site: "User registration is currently not allowed." darn.

[Angry Jew Cat - Banned for Life]

wordpress has got more holes than your local country club

[mynameisjim]

wordpress has got more holes than your local country club

No kidding. I wish they would just focus on making it secure instead of adding new features which are pretty useless. It should be a bare bones, secure foundation to which you can add plugins.

[beta-tester]

Thanks for heads up man!

[AlienQ - BANNED FOR LIFE]

Man I can not imagine the numbers of retards that spends weeks on weeks and in some cases months on months to find some silly nuance to take advantage of a software script online.

Thats life that needs a life. Fucking sad pathetic useless people.
But ya goto love it makes the software more secure in the long run.

All my blogs got that shit turned off though
THanks for the heads

[MoreMagic]

Hee stop playing security agent, still waiting on our themes

There's new Wordpress exploit out there that can be dangerous..

Affected version is the newest one (2.6.1) and it works only if you have enabled user registration option.. It is disabled by default, so if you don't know what it is, relax.. But if you have it turned on, I'd recommend you to disable it for now, until someone post solution to this.

Attacker can change the Administrator password (but the real admin will receive the new password on his e-mail, so you'll notice it for sure)

Source: http://www.milw0rm.com/exploits/6397

[kmanrox]

ive notified the wp devs just in case they didnt know

[The Duck]

thank you dude

[seeandsee]

thanks, to the top

[Ecchi22]

Hee stop playing security agent, still waiting on our themes

I'm really sorry for the huge delay! We'll talk on ICQ, my friend's PC crashed and he lost his HDD but somehow he managed to backup the files, hope I can finish them soon enough.

[u-Bob]

no surprise there... wp is one of the crappiest pieces of code out there...

[V_RocKs]

Sends the new password to the real admins email.. not your own...