Blogging Fool

To everyone using a Wordpress custom installation I strongly recommend upgrading to the latest patch version 2.8.4 which not only includes the previous point patches but prevents a malicious hack of the admin backend. Per the official statement from Automattic:

“[A] specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner.”

It is easy to install the update – simply click the upgrade button from your admin backend and confirm that you want to apply the patch. Be sure to backup your database using a plugin like Lester Chan’s excellent WP DB Manager in advance, to be sure.

Read more about the latest Wordpress security fix 2.8.4 at the official Automattic site.

Tweet This Post Plurk This Post