Attention WordPressers

Take it from somebody who lost at least one whole blog entirely from the consequences not upgrading WordPress: Upgrading your installation or patch is essential. So read this from Ian Kallen.

Also what he added by IM yesterday:

  What’s happening is: spammers are taking over blogs, posting link farm links on them, obscuring their human visibility with CSS tricks but the links are still visible to crawlers…
  All wordpress users that haven’t patched or upgraded to v2.3.3 are vulnerable.
  WordPress does not auto-update security fixes.
  …Any help you can provide getting the word out would be a mitzvah

I added the last link. 🙂


  1. Boring Site Note: Just Upgraded to WordPress 2.3.3’s avatar

    […] did so after reading this scary post from Doc. So if you notice any wacky behaviour around here, please leave a comment or send me an […]

  2. PXLated’s avatar

    That’s one reason I stay away from WordPress, too many security problems and updating is a royal pain if you use a lot of plugins, etc.
    See here –

  3. Derek K. Miller’s avatar

    Note that if you don’t want to do the whole upgrade rigamarole and want to fix the problem fast, you can download and replace only the xmlrpc.php file. I’ve done it on several WP blogs and none have been compromised:

  4. dave’s avatar

    you will really love 2.5 when it’s ready, though you can likely upgrade to the RC now…admin totally improved, security enhanced further..

  5. rob friedman’s avatar

    With the new WordPress 2.5 RC’s there is a new automatic plugin upgrade feature, making plugin upgrades simple.
    The only hard part is upgrading the WordPress itself, but even that is trivial if you use the subversion method.

    When 2.5 goes final it should be interesting.

  6. Doug’s avatar

    There is also the auto upgrade plugin which makes life easy,

  7. Wordpress 2.5 har släppts i skarp version! | KATTKORGEN’s avatar

    […] också Doc Searles blog om varför man skall uppdatera (på engelska). Den här listan är inte komplett och vi har inte […]

  8. REBLogGirl’s avatar

    I have to agree with PXLated. WP is just too insecure. Matt and his crew just write bad code and bod code leads to one thing… security issues. I’m sure there are still security holes in the new version as well having seen enough of their code in the past- remember this is the same guy that thinks PHP5 is BAD and IRRELEVANT.

  9. AZ of Mattress Toppers’s avatar

    i upgraded to the latest version just a week ago.

    Thanks for the info

  10. Hello Mary Lu » Blog Archive » Technology News: Change is Never Easy’s avatar

    […] WordPress has announced WordPress 2.5, the culmination of six months of work by the WordPress community. With this change comes a number of serious upgrades to their software. The new version is wonderful and makes writing easier. Only problem is that the upgrade and all the under side applications require hours of work. […]

  11. Doc Searls’s avatar

    REBLogGirl, are Matt & crew the only ones writing WordPress? Last I looked it was an open source project.

  12. kyle’s avatar

    I’m confused. Does this apply to wordpress blogs installed on a separate domain, or hosted on, or both? Thanks.

  13. Ron of Somali Web Design’s avatar

    Kyle, This only applies for wordpress blogs installed on a separate domains.

    FYI, all new version of WordPress 2.5 has been released containing many new features.

  14. Life is grand » Blog Archive » Hacked’s avatar

    […] [Update]Right, used a built-in theme so at least it looks OK. Probably get hacked pretty soon again though. Need to upgrade to 2.5.[/Update] [Update2]Doc Searl’s mentions the hack[/Update] […]

  15. Christopher Myers’s avatar

    Thanks for the clarification between separate domains and hosted.

  16. robin Sing’s avatar

    I have been afraid to upgrade but after reading this I guess it’s really nothing to worry about.

  17. Barry Cunningham’s avatar

    I understand that it is open source and I also understand REBloggirl’s point, ..but can’t there be a concerted effort to close the bad links in the chain?

  18. Hunter Jackson’s avatar

    I would think that it would be to the best of everyone to close off the bad links in the chain. I feel upgrading wordpress initially is just like a new Windows SP.

  19. John Sabia’s avatar

    Glad I stumbled here – I have not upgraded but will do so now.

  20. Scranton Web Design’s avatar

    That was a great post, I really enjoyed it. I will have to bookmark your site so I can come back later.

  21. Mike’s avatar

    It’s also a good idea to backup your blog’s database so that it can be restored in case of getting hacked, a crash, whatever.

  22. West Palm Beach SEO’s avatar

    Upgrading your WP blog is a simple one button install, but in some instances the accompanying plugins will also require update. It’s always best practice to first backup either internally via WP or through your hosting account (via cpanel for example).

  23. Robin’s avatar

    WordPress just came out with another version. Hopefully this upgrade will make the problems that many have experienced rendered moot.

  24. Lenny’s avatar

    I am finding that WordPress is doing all they can to keep one step ahead of the idiots out there. But of course one should indeed back up regularly especially if you are posting a lot of content. Better safe than sorry for sure.

Comments are now closed.