I'm Just Sharing

Another WordPress Update? This Time, 2.8.4

Posted by Mitch Mitchell on Aug 14, 2009

Man, this is starting to get irritating. Suddenly there’s another WordPress update, this time 2.8.4. It supposedly closes another security hole that they just discovered, but in reading the explanation, it doesn’t make a lot of sense:

“Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.”

Nope, means nothing to me. However, this is the fourth update in two months, since WordPress 2.8 was only released on June 10th. That they keep having problems with security holes, and things like internal server errors is irritating enough.

My gripe is that they still haven’t fixed whatever the problem is that keeps many of us from being able to use the automatic upgrade that supposedly comes with it. I say supposedly because ever since they added that to the WordPress software, instead of us using plugins to do the job, I haven’t been able to an automatic upgrade to a new version on any of my blogs, which I could do easily before, and some plugins won’t update either.

I’ve read where some folks say that we’re supposed to go into our server control panels and make some changes, but if that’s the case then why did it work before? Nope, I’m not buying it, and I wish they’d work on that as an issue. I did call my host to ask them about this problem, since many forums said it would be the hosting companies, and the person on the other end of the line had absolutely no idea what I was talking about, which means they haven’t been flooded with calls asking for assistance on the matter.

Well, I’ll think about upgrading this one. Based on their patterns, they’ll be releasing another update in two or three weeks, and I could wait for that one. I need to think about it; I crave security as much as the next person, and still love WordPress, but this, you have to admit, is getting a little bit ridiculous.