I just upgrade today, WordPress 2.3.2, fixed a nasty vulnerability. I haven’t did any test yet but according to “blackhat domainer” you can view WordPress Draft Entry via simple URL parameters without log in (un-authorize view).
WordPress developer had to release this ’securities’ fixes before the upcoming 2.4. You could either wait for 2.4 (the milestone is almost ready?) or upgrade immediately. But before others exploit this vulnerability its better to upgrade.
Peter Westwood’s sum up all wordpress 2.3.2 recent change and update in details. Read it first before you decide to upgrade.









2 Responses to “Upgrade Wordpress 2.3.2”
Version 2.4 isn't scheduled until late January (and these things rarely come out until after the due date), so it's best to upgrade and not give crackers a month to exploit the bug. I always use XML-RPC to post entries personally, but not exposing draft posts to unauthorized users is probably a must for most WordPress users. Oh yeah, and about your disclaimer at the bottom of the page, don't I just feel special :)
Thanks Keith, yes i agree. Security issues should be patched immediately. Anyway, it seem like there wil be no Wordpress 2.4 as it was schedules to be release on december 2007. The roadmap is now change to 2.5.
p/s: The notice is bundle with this theme I dont lnow out how to hide it yet.