Important Security fix on WordPress 2.5.1

A new WordPress release is just out on version 2.5.1 which fixes tons of bugs and a patch to a very important security vulnerability specifically if your blog is open to user registration. Those on WordPress is strongly encouraged to upgrade.

If you download the entire WordPress 2.5.1 release, you will be getting over 70 other fixes. This update focuses on fixing the most annoying bugs and improving performance. Here are some of the highlights:

  • Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
  • Better performance for those who have many categories
  • Media Uploader fixes
  • An upgrade to TinyMCE 3.0.7
  • Widget Administration fixes
  • Various usability improvements
  • Layout fixes for IE

Most importantly, a security fix is included in this update:

Yugatech 728x90 Reno7 Series

An attacker, who is able to register a specially crafted username on a WordPress 2.5 installation, is able to generate authentication cookies for other chosen accounts.

This vulnerability exists because it is possible to modify authentication cookies without invalidating the cryptographic integrity protection.

If a WordPress blog is configured to freely permit account creation, a remote attacker can gain WordPress-administrator access and then elevate this to arbitrary code execution as the web server user.

If you’ve just updated to WP 2.5, you need to get the update to fix this risky security hole.

Subscribe to Blog via Email

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

Join 365 other subscribers
Avatar for Abe Olandres

Abe is the founder and Editor-in-Chief of YugaTech with over 20 years of experience in the technology industry. He is one of the pioneers of blogging in the country and considered by many as the Father of Tech Blogging in the Philippines. He is also a technology consultant, a tech columnist with several national publications, resource speaker and mentor/advisor to several start-up companies.

6 Responses

  1. desktop computers with Intel i5 cores are the best because they are very very fast and great for multitasking “.*

  2. Avatar for Abe Olandres Abe Olandres says:

    @sylv3rblade, thanks for the tip. Got it fixed on Feedburner’s side.

  3. Avatar for penstalker penstalker says:

    aww. So WP 2.5 has a major security risk. Gotta upgrade asap.

  4. Avatar for sylv3rblade sylv3rblade says:

    ouch. hmm just upgraded.

    Umm just noticed. Sir Abe. Your main feed doesn’t seem to be working:
    It’s empty.

Leave a Reply

Your email address will not be published. Required fields are marked *