WordPress Releases Another Critical Security Update!
Barely three weeks ago the WordPress development team released two important security updates and today they have released another and likely the most critical of the three.
Matt Mullenweg, WordPress Founder sent this out as a message this morning:
Message From: Matt Mullenweg, WordPress Founder
First off, happy holidays.
I hope this time of the year, chilly for many of you, has given you time to enjoy family, friends, and loved ones and reflect on the year before and the year to come.
My last message to you this year is an important but unfortunate one: we’ve fixed a pretty critical vulnerability in WordPress’ core HTML sanitation library, and because this library is used lots of places it’s important that everyone update as soon as possible.
I realize an update during the holidays is no fun, but this one is worth putting down the eggnog for. In the spirit of the holidays, consider helping your friends as well.
You can update in your dashboard, on the “updates” tab, or download the latest WordPress here:
http://wordpress.org/download/
The official release announcement is here:
Merry WordPressing in 2011,
–
Matt Mullenweg
Generally speaking there is always the recommendation to wait ONE (and only ONE) week after a any update release to push an upgrade.
It’s preferable to wait no more than a couple days on a security upgrade because that means the vulnerability is known to everyone and you become sitting duck.
However, in this case, the nature of this particular exploit would make it wise to do your backup and get this done NOW.
Before you ever upgrade your site be sure you have a backup of both your database AND your contents (if you’re doing this by plugins that often means two separate plugins).
There are a couple different solutions for backing up, but for those nervous of doing an upgrade from there, my preferred method of backing up WordPress from within the dashboard via plugins is found here.
The one-click upgrade that is now built into WordPress generally works well particularly for these incremental updates.
However, when you start doing major version updates such as when 3.1 is released (soonish), there are ways that you can upgrade WordPress with less risk that might interest you.
It is important that you get comfortable with doing backups and upgrades on your self-hosted WordPress blog as they are a way of life.
Skipping an upgrade unless its a purely cosmetic or feature change upgrade (which the larger numbers never are only) dramatically increases your risk of code injection exploits, hacking or misuse of your site in some form or fashion.
Have fun, play safe and give me a shout if you have any questions at all!
Kimberly Castleberry
PS: The letter from Matt should convey the sense of urgency – as a letter like that is not usually sent.
PSS: Would someone please find the noobs that are beating on our beloved WordPress code and tell them to knock it off?!?! Thank you to the WordPress team for working even during the holidays to ensure that we are safe!
Andreas Pazer (152)
abhibalani (136)
Jafar Dhada (128)
Holly Jahangiri (101)
bbrian017 (62)
Justin Germino (51)
Kris Edison (47)
James Pruitt (46)
Rahul Kuntala (31)
Hajra (26)
