Warning: You must Upgrade Your WP Blog Now

hmigroupllc · 11-13-2009, 02:20 PM

I don't usually send out any threads like this, but Wordpress released an upgrade today that is specifically to stop a malicious iframe file from being injected into your server via WP.

It has happened to two of my marketing blogs the past two days.

I highly encourage you to do the upgrade immediately, or your blog web pages could disappear.

What happens is a "fake" index file is placed on your server with an iframe to a blank script.

This same code is also injected into other files.

You really need to do this upgrade.

Thanks

Wayne Sharer

tommen · 11-13-2009, 02:22 PM

Thanks for the heads up! I use 2.8.4 at the moment.I usually wait a month before upgrading because some of the plugins I use will necessarily not work after the upgrade.

Michael Oksa · 11-13-2009, 02:30 PM

Thank you, Wayne.

I know it takes a while for some of my plug-ins to catch up to new versions of WP. But I would rather be without a plug-in or two for a little while than to have my site wiped out. That's my take on it anyway.

All the best,
Michael

Istvan Horvath · 11-13-2009, 02:33 PM

To be honest, the 2.8.6 was released yesterday and the two issues addressed by this newest version have nothing to do with injection:

Quote:

2.8.6 fixes two security problems that can be exploited by registered, logged in users who have posting privileges. If you have untrusted authors on your blog, upgrading to 2.8.6 is recommended.
The first problem is an XSS vulnerability in Press This discovered by Benjamin Flesch. The second problem, discovered by Dawid Golunski, is an issue with sanitizing uploaded file names that can be exploited in certain Apache configurations.

Source: WordPress › Blog WordPress 2.8.6 Security Release

jazbo · 11-13-2009, 02:33 PM

Wordpress, dont ya love it.

redicelander · 11-13-2009, 02:34 PM

That sucks. What number upgrade is this? You talking about 2.8.5?

hmigroupllc · 11-13-2009, 02:43 PM

Well, this isn't about twisting and turning meanings and words. My host says that the Wordpress Fix issued today will stop the injections.

Whether or not it is specifically to do with the specific insecurity really doesn't matter.

I would do the upgrade, and argue semantics later.

Have a great day.

Wayne Sharer

11-13-2009, 02:52 PM

No thanks I will stay with my secured 2.6.5 version .. This is the problem, every time a update is released people go running to install it instead of waiting.

This is why you should secure your own blog and stop doing all those freaking updates just for those cool new features. Personally I find 2.8 with many issues and have found it even less user friendly than what wordpress was before.

James

Istvan Horvath · 11-13-2009, 02:57 PM

Quote:

Originally Posted by hmigroupllc

Well, this isn't about twisting and turning meanings and words.

Quote:

Originally Posted by hmigroupllc

[...] argue semantics later.

What can I do... I am linguist as my basic profession. I do care about the words and meaning

.

11-13-2009, 02:20 PM	#1
hmigroupllc HyperActive Warrior War Room Member Join Date: May 2006 Location: Washington DC, USA Posts: 142 Thanks: 0 Thanked 24 Times in 19 Posts Social Networking Contact Info	Warning: You must Upgrade Your WP Blog Now I don't usually send out any threads like this, but Wordpress released an upgrade today that is specifically to stop a malicious iframe file from being injected into your server via WP. It has happened to two of my marketing blogs the past two days. I highly encourage you to do the upgrade immediately, or your blog web pages could disappear. What happens is a "fake" index file is placed on your server with an iframe to a blank script. This same code is also injected into other files. You really need to do this upgrade. Thanks Wayne Sharer
	How Start a Flow of Quality Website Traffic You Can't Stop

11-13-2009, 02:22 PM	#2
tommen Advanced Warrior Join Date: Jul 2006 Location: St.Petersburg, Florida Posts: 771 Thanks: 43 Thanked 43 Times in 41 Posts Social Networking	Re: Warning: You must Upgrade Your WP Blog Now Thanks for the heads up! I use 2.8.4 at the moment.I usually wait a month before upgrading because some of the plugins I use will necessarily not work after the upgrade.
	Tom Lindstrom Sign up for my FREE 6-Day niche marketing mini-course now and discover step-by-step how to build a profitable niche business in 30 days or less!

11-13-2009, 02:30 PM	#3
Michael Oksa The Ethical Marketer War Room Member Join Date: May 2006 Location: Wisconsin, USA Posts: 6,058 Thanks: 1,750 Thanked 3,025 Times in 1,340 Posts Social Networking Contact Info	Re: Warning: You must Upgrade Your WP Blog Now Thank you, Wayne. I know it takes a while for some of my plug-ins to catch up to new versions of WP. But I would rather be without a plug-in or two for a little while than to have my site wiped out. That's my take on it anyway. All the best, Michael
	* * IT'S HERE! IT'S HOT * * . . . *The Ultimate* 2011 Christmas Holiday Package!**

11-13-2009, 02:33 PM	#5
jazbo Systematic Warrior War Room Member Join Date: Oct 2009 Location: Norfolk, England. Posts: 1,906 Blog Entries: 9 Thanks: 35 Thanked 298 Times in 217 Posts Social Networking	Re: Warning: You must Upgrade Your WP Blog Now Wordpress, dont ya love it.
	Linkbuilding Does Not Have To Be Painful.

11-13-2009, 02:34 PM	#6
redicelander J Bold War Room Member Join Date: Jul 2008 Location: Walla Walla Posts: 2,612 Blog Entries: 10 Thanks: 665 Thanked 507 Times in 311 Posts Social Networking	Re: Warning: You must Upgrade Your WP Blog Now That sucks. What number upgrade is this? You talking about 2.8.5?
	"I know that this works because I've done this before and made $50-$150/day" Turn Every Website Visitor into $4-$6 *$1 Trial! Can you get $1000 checks as an Offline Informer?*

11-13-2009, 02:43 PM	#7
hmigroupllc HyperActive Warrior War Room Member Join Date: May 2006 Location: Washington DC, USA Posts: 142 Thanks: 0 Thanked 24 Times in 19 Posts Social Networking Contact Info	Re: Warning: You must Upgrade Your WP Blog Now Well, this isn't about twisting and turning meanings and words. My host says that the Wordpress Fix issued today will stop the injections. Whether or not it is specifically to do with the specific insecurity really doesn't matter. I would do the upgrade, and argue semantics later. Have a great day. Wayne Sharer
	How Start a Flow of Quality Website Traffic You Can't Stop

11-13-2009, 02:52 PM	#8
TheRichJerksNet Guest Posts: n/a	Re: Warning: You must Upgrade Your WP Blog Now No thanks I will stay with my secured 2.6.5 version .. This is the problem, every time a update is released people go running to install it instead of waiting. This is why you should secure your own blog and stop doing all those freaking updates just for those cool new features. Personally I find 2.8 with many issues and have found it even less user friendly than what wordpress was before. James
TheRichJerksNet Guest Posts: n/a