If you allow open registration on your blog, you should definitely upgrade. With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password. Stefan Esser will release details of the complete attack shortly. The attack is difficult to accomplish, but its mere possibility means we recommend upgrading to 2.6.2.

You can download Wordpress 2.6.2 here.

First order of business – I decided to replace all the Wordpress 2.5.1 files with a fresh set. I basically just followed my instructions on updating a Wordpress blog. This didn’t work but when I viewed the code at my home page (which was still coming up blank), I remarked that there was considerably less code than before. So something had partially worked.

I began looking through the files on my website through the ftp application.

Here’s a shot of the files that they had somehow uploaded into my website files. Nice! Some good old fashioned poker sites. I deleted those and deleted any other questionable files. Since I upgrade Wordpress on a regular basis and do so with about 50 blogs, I know what files are legitimate and which ones are bogus.

Next, I took a look at my Wordpress plug-ins. They had added one called pre_adsense.php. Here’s the code that was in that file.

I deleted that file. Btw, I checked the home page again after deleting the poker files. No go. I checked it again after deleting the pre_adsense.php plugin. No go again. I started deleting all my Wordpress plug-ins. After I deleted adsense.php, the blog worked fine again. For safety measures, I now prevent any users from registering, and I checked to make sure that I had deleted all users (other than myself).

There’s my tale of Wordpress blog woe. Don’t be a victim. Keep a vigilant eye on your blogs and keep updated. I need to contact the author of the adsense.php plug-in and see if he is aware of this hack or if he has an update to adsense.php.

update: I was looking at some of their files that they had uploaded onto my website. How ’bout the nerve to claim a copyright on the following – I guess they can sue me for copyright violation:

Strip Poker A Telecharger

Strip poker a telecharger Il annonce “Non”. Strip poker a telecharger A l’occasion que vous avez la possibilité de choisir parmi les jeux sur Casino en line, ils sont distribués en Europe, mais aussi dans les casinos. Lu but du joueur – tous les jeux de casino peuvent effectuer au jeu de la brique, fournie essentiellement par la ligne extérieure, entre les deux cartes de même couleur. Séquence – c’est une surenchère sur un pari sur une des tables les plus joués et les nombres 0 et 00. Strip poker a telecharger La première donne des deux mains distinctes. Strip poker a telecharger Le joueur rajoute une mise, égale à une origine très ancienne. Strip poker a telecharger Le mot “casino” vient du mot italien “casa” et c’est pourquoi ils font moins de un à sept joueurs. Au jeu de Craps est que le joueur mise le même nombre de joueurs au Black Jack Naturel, il ramasse les mises externesLes mises externes de la sécurité des transactions et la Gare de Kyoto lui rend également hommage : outre un mini-cinéma et un 10 totalisent à 21, mais ce jeu captivant.La Quinte Flush ROYALE.Vidéo Poker – comment jouerTous les jeux, présentés sur Jouez LigneBienvenue sur Jeu Casino offre à chaque joueur est de placer le pari rapporte 15 fois la mise.”NE PASSE PAS” – c’est la main du joueur ou celle de la mise initiale. Dans une ambiance calme et bien sécurisé, où la troisième carte, tirée du sabot représentent la donne des cartes, nécessaires pour sélectionner un jeu de Black Jack, il ne peut pas doubler sur un des joueurs et des ordinateurs, facilite l’apparition de centaines de casinos et bonne chance!Casino Jeu – un des numéros est colorée en rouge, et la ville d’Enghien-les-Bains est le fonctionnement d’une machine à Vidéo Poker commence à distribuer les cartes séparées sont deux numéros côte à côte, et cela peut prendre un repas.Au 31 mars 2006), le Casino au monde, depuis le XVIIIème siècle. Les casinos en ligne – comment jouerOnline Gambling vous donne la possibilité de se mettre en aventure aux jeux gratuits permettent aux débutants d’apprendre les règles et la terminologie du jeu”Parier” – on dit stand, quand le joueur se souvienne de chaque joueur de sélectionner un casino classique. L’avantage des jeux sur Casinos Gratuits, faites de bons jeux et bonne chance!Casino en ligne – c’est quoiLe casino en line – BienvenueBienvenue sur notre site vous garantissent le plaisir des joueurs, ainsi que des jackpots progressifs. Strip poker a telecharger Chaque jouer de jouer et pour la valeur du montant des jetons, qui lui conviennent, quand il choisit parmi les jeux gratuits. Vous pouvez trouver plusiers sites, qui proposent des jeux sur Casinos permettent aux joueurs de jouer sans miser de l’argent réel sur Casino Jeu peuvent être joués sur Internet, vous pouvez également apprendre les règles des jeux avec et les jeux de casino sans téléchargement sont le plus de clients qu’ils ne soient pas au premier lancer – c’est un montant additionnel, égal à 8 ou 9, on appelle cela un “Craps” et dans des fourreaux. Les sept captages d’eau sulfureuse existants fournissent de 10 points. Strip poker a telecharger La valeur de leur numéro facial.
Copyright 2007 strip poker a telecharger

Well, that’s my rant and here’s the full scoop from the Wordpressers:

Version 2.5.1 of WordPress is now available. It includes a number of bug fixes, performance enhancements, and one very important security fix. We recommend everyone update immediately, particularly if your blog has open registration. The vulnerability is not public but it will be shortly.

In addition to the security fix, 2.5.1 contains many bug fixes. If you are interested only in the security fixes, you can download these corrected copies of wp-includes/pluggable.php, wp-admin/includes/media.php, and wp-admin/media.php. Replace your existing copies of these files with these new copies.

If you download the entire 2.5.1 release, you will be getting over 70 other fixes. 2.5.1 focuses on fixing the most annoying bugs and improving performance. Here are some highlights:

Performance improvements for the Dashboard, Write Post, and Edit Comments pages.
Better performance for those who have many categories
Media Uploader fixes
An upgrade to TinyMCE 3.0.7
Widget Administration fixes
Various usability improvements

Layout fixes for IE

1 – When working with images, go ahead and upload all your images at once and then add them one by one to your post. This seems to be the easiest way to work with images in Wordpress 2.5 that I’ve found. Also, if you follow an image naming scheme like – wordpressdashboard01.jpg, wordpressdashboard02.jpg, etc., you can insert the first image and from there just copy the code and change the image number for future images

2 – Wordpress 2.5 now searches pages and posts when you do a search in the Wordpress search box. I didn’t realize that prior Wordpress versions only searched the posts. I often add my own google search box in the side bar to go with google searches of my sites instead.

This is a nice way to handle a bunch of photos quickly and easily.

Wordpress Stats in Dashboard

Wordpress also gives you some cool data on posts and pages.


Wordpress Dashboard

I’m still having issues with uploading images as I don’t always get the “Insert into Post” button after uploading an image.

One of my biggest complaints about Wordpress was that their default text box for writing posts was tiny. You could increase the size in the options menu but sometimes the change would not take on posts that were written prior to the change in the options menu. So if you went to edit a post that you had written prior to increasing the size of the text box, you would be stuck with the old tiny text box.

Well, the folks at Wordpress finally fixed that in version 2.5.

Check out the bottom right corner of this picture. You can grab the edge with your mouse pointer and just stretch or compress the text box to any size you want. Now I can see the whole post or most of the post without scrolling up and down all day! Good job, Wordpress!

You’ll see it here where the “Add Image” balloon has popped up. Click on that and you get the following pop up screen:

From here you can upload the image or specify the image url, add a caption, add a description, align the image, link the image, and choose the size of the image to be inserted.

It seems like uploading the image is a bit faster with Wordpress 2.5. I had some trouble getting the “Insert Image in Post” selection to come up. This may be a bug in Wordpress 2.5 RC2 yet. Overall, it’s a pretty slick renovation of Wordpress.

In Wordpress 2.5, you can update your plugins directly from the plugin menu of the Wordpress Dashboard. No more downloading the plugin and then uploading it to your blog via ftp. Now, it’s just one click upgrade. Nice feature! Way to go Wordpress.

And that’s your daily wordpress tip.