WordPress worm dangerous, but easily fixed

WordPress blog owners, hoping for a quiet Labor Day holiday weekend, were likely not thrilled to wake up on Saturday to learn about a nasty worm infesting WordPress blogs. I first learned about this from this Mashable article. It turns out that the worm took advantage of a security leak in older versions of WordPress.

Matt Mullenweg, WordPress founder described the worm in the WordPress blog:

"Right now there is a worm making its way around old, unpatched versions of WordPress. This particular worm, like many before it, is clever: It registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts."

The good news is that you can protect yourself easily by just upgrading to the latest version of WordPress, 2.8.4, which is immune to the worm. WordPress, to their credit, was right on the problem and got word out quickly about the fix. What's even better is that the upgrade was simple and easy to do. It is literally a single click to upgrade.

My partner, Julie Roads, upgraded our socmedia101.com on Sunday and it upgraded just as easily as advertised. If you're wondering if you have been attacked, Lorelee on WordPress reported you could tell you had been attacked if you saw the following:

• There are strange additions to the pretty permalinks, such as example.com/category/post-title/%&(%7B$%7Beval(base64_decode($_SERVER%5BHTTP_REFERER%5D))%7D%7D|.+)&%/. The keywords are “eval” and “base64_decode.”
• The second clue is that a “back door” was created by a “hidden” Administrator. Check your site users for “Administrator (2)” or a name you do not recognize. You will probably be unable to access that account.

The bottom line is that the bug is easily fixed. If you haven't upgraded yet, you should do so as soon as possible.

For more information:
- see Matt Mullenweg's post on WordPress

Related Articles:
New worm attacks unpatched WordPress blogs
RSS cloud provides instant blog publishing
Top three web CMS for small publishers