{"id":153,"date":"2008-06-03T15:27:29","date_gmt":"2008-06-03T12:27:29","guid":{"rendered":"https:\/\/www.optimiced.com\/en\/?p=153"},"modified":"2008-06-03T15:30:58","modified_gmt":"2008-06-03T12:30:58","slug":"wordpress-233-not-safe","status":"publish","type":"post","link":"https:\/\/www.optimiced.com\/en\/2008\/06\/03\/wordpress-233-not-safe\/","title":{"rendered":"WordPress 2.3.3 is not safe anymore – upgrade NOW! (link injection vulnerability)"},"content":{"rendered":"

A few days ago I was recommending to people not to upgrade to version 2.5 of WordPress, because at the time I believed WP 2.3.3 to be as stable and safe as the new 2.5 series. Besides, I liked (and still like) the old, ‘classic’, 2.3.x admin interface much more…<\/p>\n

OK, I must take my words back and confirm that WordPress 2.3.3<\/strong>, the last stable release before the new WordPress<\/a> 2.5 branch was released, is not safe anymore<\/strong>, and you can become a victim of the link injection hack (vulnerability)<\/em>.<\/p>\n

What happened?<\/p>\n

In one of the blogs, which I support (luckily, not my personal blog, which I have upgraded to 2.5\/2.5.1 long ago), I have found ‘hidden’ links (code: <u style=\"display: none\">[ bunch of spam links inserted here ]<\/u><\/code>) in one of the regular posts there.<\/p>\n

<\/p>\n

I checked the whole blog after that, all of the archives, and the hidden links were found only in two blog posts — but this doesn’t mean that at a later point, the hacker won’t try to insert some 50 or even 500 more of these…<\/p>\n

Now I am performing an upgrade to WP 2.5.1<\/a>, the latest stable available for download.<\/p>\n

After that, I’ll ask all of the authors in this blog to change their passwords, and after that, we’ll see…<\/p>\n

Actually, I am sure that after that we’ll have to upgrade to 2.5.2, then to 2.6, etc., etc., but I guess, there’s nothing else to be done.<\/p>\n

Last, but not least, I recommend to all WordPress users to upgrade carefully, and often. The danger of discovering one day, that your blog became a victim of some stupid spammer, trying to ‘sell’ his black hat SEO links<\/em>, using your hacked WP, is quite real, and the only measure against this is: upgrade!<\/strong> :-)<\/p>\n

\/\/Sideline: I still do not like the new WP 2.5 admin interface (and not only<\/a> I;-), and I just hope, that in 2.6 things will look better (and more usable) — or at least, the Write section will be improved…<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"

A few days ago I was recommending to people not to upgrade to version 2.5 of WordPress, because at the time I believed WP 2.3.3 to be as stable and safe as the new 2.5 series. Besides, I liked (and still like) the old, ‘classic’, 2.3.x admin interface much more… OK, I must take my…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-153","post","type-post","status-publish","format-standard","hentry","category-wordpress"],"_links":{"self":[{"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/posts\/153","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/comments?post=153"}],"version-history":[{"count":0,"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/posts\/153\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/media?parent=153"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/categories?post=153"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.optimiced.com\/en\/wp-json\/wp\/v2\/tags?post=153"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}