Wordpress users beware! [Vulnerability] - GoFuckYourself.com

Ecchi22 · 09-07-2008, 11:14 PM

There's new Wordpress exploit out there that can be dangerous..

Affected version is the newest one (2.6.1) and it works only if you have enabled user registration option.. It is disabled by default, so if you don't know what it is, relax.. But if you have it turned on, I'd recommend you to disable it for now, until someone post solution to this.

Attacker can change the Administrator password (but the real admin will receive the new password on his e-mail, so you'll notice it for sure)

Source: http://www.milw0rm.com/exploits/6397

Ecchi22 · 09-07-2008, 11:15 PM

If you wanna check if your blog have registration enabled just go to yourblog.com/wp-login.php?action=register

Aussie Rebel · 09-07-2008, 11:22 PM

thanks and bump

klaze · 09-07-2008, 11:48 PM

my enemie's site: "User registration is currently not allowed." darn.

Angry Jew Cat - Banned for Life · 09-07-2008, 11:59 PM

wordpress has got more holes than your local country club

mynameisjim · 09-08-2008, 12:04 AM

Quote:

Originally Posted by Angry Jew Cat

wordpress has got more holes than your local country club

No kidding. I wish they would just focus on making it secure instead of adding new features which are pretty useless. It should be a bare bones, secure foundation to which you can add plugins.

beta-tester · 09-08-2008, 02:18 AM

Thanks for heads up man!

AlienQ - BANNED FOR LIFE · 09-08-2008, 02:23 AM

Man I can not imagine the numbers of retards that spends weeks on weeks and in some cases months on months to find some silly nuance to take advantage of a software script online.

Thats life that needs a life. Fucking sad pathetic useless people.
But ya goto love it makes the software more secure in the long run.

All my blogs got that shit turned off though

THanks for the heads

MoreMagic · 09-08-2008, 03:26 AM

Hee stop playing security agent, still waiting on our themes

Quote:

Originally Posted by Ecchi22

There's new Wordpress exploit out there that can be dangerous..

Affected version is the newest one (2.6.1) and it works only if you have enabled user registration option.. It is disabled by default, so if you don't know what it is, relax.. But if you have it turned on, I'd recommend you to disable it for now, until someone post solution to this.

Attacker can change the Administrator password (but the real admin will receive the new password on his e-mail, so you'll notice it for sure)

Source: http://www.milw0rm.com/exploits/6397

kmanrox · 09-08-2008, 03:32 AM

ive notified the wp devs just in case they didnt know

The Duck · 09-08-2008, 03:33 AM

thank you dude

seeandsee · 09-08-2008, 03:52 AM

thanks, to the top

Ecchi22 · 09-08-2008, 04:25 AM

Quote:

Originally Posted by MoreMagic

Hee stop playing security agent, still waiting on our themes

I'm really sorry for the huge delay! We'll talk on ICQ, my friend's PC crashed and he lost his HDD but somehow he managed to backup the files, hope I can finish them soon enough.

u-Bob · 09-08-2008, 12:11 PM

no surprise there... wp is one of the crappiest pieces of code out there...

V_RocKs · 09-08-2008, 02:45 PM

Sends the new password to the real admins email.. not your own...

09-07-2008, 11:14 PM	#1
Ecchi22 Too lazy to set a custom title Industry Role: Join Date: Nov 2005 Posts: 10,012	Wordpress users beware! [Vulnerability] There's new Wordpress exploit out there that can be dangerous.. Affected version is the newest one (2.6.1) and it works only if you have enabled user registration option.. It is disabled by default, so if you don't know what it is, relax.. But if you have it turned on, I'd recommend you to disable it for now, until someone post solution to this. Attacker can change the Administrator password (but the real admin will receive the new password on his e-mail, so you'll notice it for sure) Source: http://www.milw0rm.com/exploits/6397 __________________

09-07-2008, 11:15 PM	#2
Ecchi22 Too lazy to set a custom title Industry Role: Join Date: Nov 2005 Posts: 10,012	If you wanna check if your blog have registration enabled just go to yourblog.com/wp-login.php?action=register __________________

09-08-2008, 02:18 AM	#7
beta-tester Rock 'n Roll Baby! Join Date: Sep 2004 Location: USA, temporarly Posts: 22,562	Thanks for heads up man! __________________ Sig for sale. Affordable prices. Contact me and get a great deal ;) My contact: ICQ: 944-320-46 e-mail: manca {AT} HotFreeSex4All.com

09-08-2008, 02:23 AM	#8
AlienQ - BANNED FOR LIFE best designer on GFY Join Date: Mar 2003 Location: IALIEN.COM - High Definition Video and Photographic Productions -ICQ 78943384 Posts: 30,307	Man I can not imagine the numbers of retards that spends weeks on weeks and in some cases months on months to find some silly nuance to take advantage of a software script online. Thats life that needs a life. Fucking sad pathetic useless people. But ya goto love it makes the software more secure in the long run. All my blogs got that shit turned off though THanks for the heads __________________ NAKED HOSTING FTW!11 I'm On The INSANE PLAN $9.95/mo! \| The Alien Blog Adult News Worth Reading Updated Daily \| Content For Sale! 641 PICS 216 MINUTES OF VIDEO $350.00 \|ICQ: 78943384 \| Last edited by AlienQ - BANNED FOR LIFE; 09-08-2008 at 02:24 AM..

09-08-2008, 03:32 AM	#10
kmanrox aka K-Man Industry Role: Join Date: Oct 2001 Location: The Gutter Posts: 29,292	ive notified the wp devs just in case they didnt know __________________ Crypto HODLr Crypto mining Angel investor

09-07-2008, 11:22 PM	#3
Aussie Rebel Blow Me U Geeks Join Date: Aug 2001 Location: Maximum Security Posts: 5,108	thanks and bump

09-07-2008, 11:48 PM	#4
klaze So Fucking Banned Join Date: May 2008 Location: Adult Marketing Mecca Posts: 2,167	my enemie's site: "User registration is currently not allowed." darn.

09-07-2008, 11:59 PM	#5
Angry Jew Cat - Banned for Life (felis madjewicus) Industry Role: Join Date: Jul 2006 Location: In Mom & Dad's Basement Posts: 20,368	wordpress has got more holes than your local country club

09-08-2008, 03:33 AM	#11
The Duck Adult Content Provider Industry Role: Join Date: May 2005 Location: Europe Posts: 18,243	thank you dude __________________ Skype Horusmaia ICQ 41555245 Email [email protected]

09-08-2008, 03:52 AM	#12
seeandsee Check SIG! Industry Role: Join Date: Mar 2006 Location: Europe (Skype: gojkoas) Posts: 50,945	thanks, to the top __________________ BUY MY SIG - 50$/Year Contact here

09-08-2008, 12:11 PM	#14
u-Bob there's no $$$ in porn Industry Role: Join Date: Jul 2005 Location: icq: 195./568.-230 (btw: not getting offline msgs) Posts: 33,063	no surprise there... wp is one of the crappiest pieces of code out there...

09-08-2008, 02:45 PM	#15
V_RocKs Damn Right I Kiss Ass! Industry Role: Join Date: Dec 2003 Location: Cowtown, USA Posts: 32,409	Sends the new password to the real admins email.. not your own...