Today WordPress relese a new version, WordpRess 2.8.4. Matt say :

Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.

We fixed this problem last night and have been testing the fixes and looking for other problems since then. Version 2.8.4 which fixes all known problems is now available for download and is highly recommended for all users of WordPress.

Well a great job for WordPress team, fixed the security hole as fast as they can. So to those who using a WordPress as a self-hosted platform, you better hurry up to upgrade as soon as posible to patch the security.

WordPress Version 2.8.4 can be download here 

If you wanna see the WordPress antusias pingback, you can go directly to WordPress Security Relese.

Keep on the good work team :D

» Read More...

WordPress 2.8.2 fixes an XSS vulnerability. Comment author URLs were
not fully sanitized when displayed in the admin. This could be
exploited to redirect you away from the admin to another site.  Download 2.8.2 or automatically upgrade from the Tools->Upgrade page of your blog’s admin.

For who using wordpress platform for blogging theres a new version
release which is version 2.8.2 and it claimed ready.
You can start to test through your webhosting and it can be download it  here, you also can check the antusias pinging here

» Read More...

For who using wordpress platform for blogging theres a new beta release which is version 2.8.1 Beta 2 and it claimed ready for testing. You can start to test through your webhosting and it can be download it here, you also can check out the major changes since beta 1, and review all tickets fixed in 2.8.1. 

Notable fixes in beta 2:

• Translation of role names fixed
• wp_page_menu() defaults to sorting by the user specified menu order rather than the page title
• Upload error messages are now correctly reported
• Autosave error experienced by some IE users is fixed
• Styling glitch in the plugin editor fixed
• SSH2 filesystem requirements updated
• Switched back to curl as the default transport
• Updated the translation library to avoid a problem with mbstring.func_overload

To see the detai you can visite their post here :
http://wordpress.org/development/2009/06/wordpress-2-8-1-beta-2/

So if you are a wp plugin developer, you better check this out a.s.a.p to sincronize your scripting stability.

» Read More...