A few words about the RISKS of WordPress 1.2, 1.5, 2.0 or anything less than 2.0.4

A Layman’s Guide to WordPress Security Fixes

It seems like people who are running the latest do continue to upgrade, but as for the rest of the WP users – they must be convinced. They will only be convinced when they are told of the danger. That’s where you and I come in.

1.2 was an open door. (I had my index.php hacked 3 or four times under that version.)

1.5 solved that problem, but it reminded me of living in the backwoods of Pennsylvania. We locked screen door with a eye and hook latch. A stick picked up off the ground allowed you to pry the hook up and get in. When I lived on that old dirt road, that didn’t even have a road sign at the end of it, we didn’t have a lot of tourists. But with WordPress, we’re talkin’ the “Information Superhighway” baby. Running a website is like having an exit ramp for your front yard. You want a little more protection than a screen door.

2.0.2 put a regular lock on the door, but that lock could be “jimmied” by anyone who’d ever read a Hardy Boys novel (or a FAQ on hacking)

2.0.3 put a dead bolt on the main door, but left the windows unlocked. The deadbolt is called a NOnce. The only problem was that no-one thought to lock the windows. You couldn’t get into most administration pages anymore unless you REALLY were allowed. However, many plugins assumed that they didn’t have to have their own security checks. This left the plugin configuration pages vulnerable to attack.

2.0.4 finally locked both the doors and the windows . Must plugin configuration pages are now safe. However, you should know that ANY plugin can open a security hole. Make sure you use plugins that were written by people who know at least a little about security issues.

2.0.5 and 2.0.6 each have specific security fixes and should be loaded, but these are all “one up” changes that address a specific problem with a specific section of code. The earlier 2.0.x releases all included broad sweeping security changes. That’s why I have 2.0.4 in my title and not 2.0.6 or 2.1.

My simple searches (now two months old – sorry, I’m not updating them AGAIN) show potentially five million sites in need of an update, and yet no one is talking about 1.2 or 1.5 security holes any more. So, these sites are identified and hacked one by one. Those sites have been basically abandoned to fare on their own. So, it is up to us, as fellow bloggers who know better, to explain the risks to these people. You can help.