WordPress version 2.8.5 was released earlier today which addressed several security issues. The WordPress core team had identified several security hardening changes while working on WordPress 2.9 and felt it was worth the effort to back-port these changes to the 2.8 branch.
The headline changes in this release are:
- A fix for the Trackback Denial-of-Service attack that is currently being seen.
- Removal of areas within the code where php code in variables was evaluated.
- Switched the file upload functionality to be whitelisted for all users including Admins.
- Retiring of the two importers of Tag data from old plugins.
It is recommended to download and upgrade to version 2.8.5 or use the automatic upgrade function of WordPress under Tools > Upgrade from the admin area.
Related posts:
Thanks for the heads up… time to upgrade!