Picture Perfect Paranoia

… and I thought I was being kind of paranoia. Heh.

From maestro:

I have just learned of a very serious security hole in Word Press that affects all versions (including the most recent). This security hole allows ANY registered user to gain Admin privileges, which allows them to do anything they want to your blog, including deleting all your content, posting spam posts, etc. To close this hole until a new version is released (v 2.2.1 should be out soon and fixes the problem) you will need to disable new user registration on your blogs.

I’ll send out another E-mail once we’re ready to do upgrades after the new version is out letting everyone know the process for requesting their Word Press be upgraded to the new version. For those curious about the technical details of the security hole, read on. For the technically inclined peeps:

This security hole allows for Remote SQL Injection. SQL Injections allows an attacker to insert new data, or modify existing data, in the database of the blog. Basically this gives them full control, as having access to the database trumps anything else. The exploit is not just academic, at least one blog has been attacked with it so far.

I already did my part. How about yours?