Critical WordPress Vulnerability discovered

A critical security bug discovered in WordPress can cause an attacker to cripple not only your website, but the entire server your website resides on. This is due to the vulnerability in the PHP XML parser used by WordPress’ XMLRPC implementation.

This bug affects Drupal installations as well (Drupal 6 & 7)

A reasonably skilled attacker can exploit this bug and cause your server to run out of memory simply by sending a 200+ KB XML file.

This bug is critical enough to cause the security team at WordPress to backport the affected files to the earlier versions, i.e. WordPress 3.7 and WordPress 3.8

If you are currently running WP 3.7 or WP 3.8 branch, please update to the latest .4 version.

The following versions are patched against this security bug.
Wordpress 3.7.4
Wordpress 3.8.4
Wordpress 3.9.2

The following files are updated:
readme.html
wp-admin/about.php
wp-includes/ID3/getid3.lib.php
wp-includes/class-IXR.php
wp-includes/class-wp-customize-widgets.php
wp-includes/compat.php
wp-includes/pluggable.php
wp-includes/version.php
wp-login.php

For more details, please visit: http://codex.wordpress.org/Version_3.9.2

Comments 29

  1. fendi boots wrote:

    I blog often and I truly appreciate your content.

    This great article has really peaked my interest. I will book mark your site and
    keep checking for new information about once a week. I subscribed to your RSS feed as well.


    Addendum ...

    Posted 08 Aug 2014 at 4:25 am
  2. how to hack someone' wrote:

    Very quickly this website will be famous amid all blog users, due to
    it’s fastidious content


    Addendum ...

    Posted 11 Aug 2014 at 7:49 pm
  3. shawn elliott wrote:

    Hi there, just be?ame alert t? your blog thr?ugh Go?gle, and found that it is really informative.
    ? am g?ing t? watch out for br?ssels. I will a?preciate if you continue thi? in future.
    Nume?ous people willl be benefited from your writing.
    Cheers!


    Addendum ...

    Posted 12 Aug 2014 at 11:29 am
  4. red little tikes wrote:

    What’s up Dear, are you genuinely visiting this site regularly,
    if so after that you will definitely get pleasant experience.


    Addendum ...

    Posted 12 Aug 2014 at 7:09 pm
  5. Elisa wrote:

    If you have light colored tiles on your
    roof, your attic will absorb minced or less heat. You’ll also need to purchase a business insurance policy
    to protect you against claims for damage done to the property and to protect your equipment.

    If that holds true for the Colossal squid, this male specimen that was captured could very well be dwarfed by a much larger female of
    the species.


    Addendum ...

    Posted 13 Aug 2014 at 8:31 am
  6. giay dep tieu duong wrote:

    You really make it appear really easy with your presentation but I in finding this matter to be really something that I feel
    I might never understand. It kind of feels too complex and extremely vast for me.

    I’m taking a look forward on your subsequent publish, I will
    try to get the dangle of it!


    Addendum ...

    Posted 13 Aug 2014 at 11:32 am
  7. Starla wrote:

    Hi! I know this is somewhat off topic but I was wondering which blog platform
    are you using for this website? I’m getting fed up of WordPress
    because I’ve had problems with hackers and I’m looking at options for another platform.

    I would be awesome if you could point me in the direction of a good platform.


    Addendum ...

    Posted 13 Aug 2014 at 12:24 pm
  8. basement lowering wrote:

    I am really enjoying the theme/design of your website.
    Do you ever run into any internet browser compatibility problems?
    A handful of my blog readers have complained about my blog not working correctly in Explorer but
    looks great in Opera. Do you have any recommendations to help fix this issue?


    Addendum ...

    Posted 13 Aug 2014 at 2:43 pm
  9. John Hayson wrote:

    With havin so much content do you ever run into any problems of plagorism or copyright infringement?
    My blog has a lot of unique content I’ve either created myself or outsourced but it looks like a lot of it is popping it up all over the web without my agreement.
    Do you know any methods to help stop content
    from being ripped off? I’d truly appreciate it.


    Addendum ...

    Posted 13 Aug 2014 at 3:00 pm
  10. cheap hotels wrote:

    Hi friends, nice piece of writing and nice arguments commented here, I am truly enjoying by these.


    Addendum ...

    Posted 13 Aug 2014 at 3:21 pm
  11. how to hack a wrote:

    I abs?lutely lo?e your web?ite.. Excellent colors & theme.
    Did you m?ke this ?ebsite you?self? Pleas? r?ply
    b?ck as I’m planning to create my own w?bsite and
    w?uld l?ve to know w?ere you got this from or exactly what the theme is called.
    Thank you!


    Addendum ...

    Posted 13 Aug 2014 at 5:31 pm
  12. genten ?? ?? wrote:

    Hi everyone, it’s my first pay a visit at this site, and article is truly fruitful in support of me, keep up posting such content.


    Addendum ...

    Posted 13 Aug 2014 at 10:40 pm
  13. ranking bonusow wrote:

    Have you ever thought about including a little bit more than just
    your articles? I mean, what you say is valuable and all.
    Nevertheless think of if you added some great visuals
    or video clips to give your posts more, “pop”! Your content is excellent but with images and videos, this
    site could certainly be one of the very best in its field.

    Fantastic blog!


    Addendum ...

    Posted 14 Aug 2014 at 7:42 am
  14. My Freedom Smokes wrote:

    It’s amazing in support of me to have a web site, which is helpful for my knowledge.

    thanks admin


    Addendum ...

    Posted 14 Aug 2014 at 8:33 am
  15. Insurance Agent/ wrote:

    My partner and I stumbled over here by a different website and
    thought I might check things out. I like what I see so now
    i am following you. Look forward to finding out about your web page
    for a second time.


    Addendum ...

    Posted 14 Aug 2014 at 9:19 am
  16. Whol Durable Goods wrote:

    Does your site have a contact page? I’m having problems locating
    it but, I’d like to shoot you an e-mail. I’ve got some creative ideas for your blog you might
    be interested in hearing. Either way, great website and I look
    forward to seeing it develop over time.


    Addendum ...

    Posted 14 Aug 2014 at 9:33 am
  17. mechanical kitchen wrote:

    Nice post. I learn something totally new and challenging on sites
    I stumbleupon every day. It’s always helpful to read through content from other writers and
    practice something from other web sites.


    Addendum ...

    Posted 14 Aug 2014 at 11:10 am
  18. seo writing wrote:

    Hmm is anyone else encountering problems with the images on this blog loading?
    I’m trying to find out if its a problem on my end or if it’s the blog.
    Any feedback would be greatly appreciated.


    Addendum ...

    Posted 14 Aug 2014 at 1:42 pm
  19. Solar Energy wrote:

    It’s remarkable to pay a visit this site and reading the
    views of all colleagues regarding this piece of writing,
    while I am also zealous of getting knowledge.


    Addendum ...

    Posted 14 Aug 2014 at 4:10 pm
  20. Benny wrote:

    ?hank you f?r the good w?iteup. It in fact was a amusement account
    it. L?ok advanced to far added agreeable from you!
    By the way, how can we communicat??


    Addendum ...

    Posted 14 Aug 2014 at 9:35 pm
  21. moving to hawaii wrote:

    Hello, I enjoy reading through your article post. I wanted to write a little comment to support you.


    Addendum ...

    Posted 15 Aug 2014 at 3:34 am
  22. Video Making wrote:

    I have been exploring for a little bit for any high-quality articles
    or blog posts on this sort of area . Exploring in Yahoo I finally stumbled upon this website.
    Reading this info So i am satisfied to exhibit that I’ve a very good uncanny feeling
    I came upon just what I needed. I such a lot indisputably will make certain to do not overlook this website and provides it a glance regularly.


    Addendum ...

    Posted 15 Aug 2014 at 6:07 am
  23. Seeking Health wrote:

    Hola! I’ve been reading your blog for a long time now and finally got the
    bravery to go ahead and give you a shout out from New Caney Tx!
    Just wanted to say keep up the fantastic job!


    Addendum ...

    Posted 16 Aug 2014 at 3:13 am
  24. libertad de palabra wrote:

    Querétaro, Qro.- Tras una carta enviada en enero al
    gobernador de Querétaro, el coordinador de comunicación social, Abel Ernesto Magaña Álvarez, rectificó su postura de cancelar
    a Libertad de Palabra la propuesta publicitaria que nuestro
    medio le hizo para este 2011.
    Abel Ernesto Magaña Álvarez

    Al parecer, en Gobierno Estatal aplican la frase “no pago para que me peguen”.
    Foto: Agencia SieteFoto.

    El anuncio de la cancelación de la propuesta publicitaria –que incluye otros
    servicios adicionales a los ofrecidos en 2010–, ocurrió unas horas después de
    publicar la nota titulada: “Los errores de Jorge García Quiroz”, quien era el secretario de gobierno.

    En la llamada se nos dijo que por órdenes de Abel Magaña Álvarez se nos informaba que nuestra propuesta publicitaria finalmente no sería aceptada al
    80%, como ya nos lo había informado el propio Abel,
    sino sólo al 20%, y que el trámite podría llevarse “varias semanas”.

    Así se le informó en carta al gobernador, José Eduardo Calzada Rovirosa, lo que al parecer derivó en que Magaña Álvarez rectificara,
    aunque nos aclaró que se tendría que hacer
    un convenio con el monto menor, similar a lo contratado en el 2010 (convenio 1), y otro adicional hasta
    alcanzar el monto acordado (convenio 2).

    Sin embargo, para no retrasar los pagos, Magaña Álvarez nos solicitó la factura de enero,
    misma que se entregó en su oficina el pasado 16 de enero, bajo el concepto: Según convenio publicitario 2011 (enero).

    Acto seguido, solicitó que pasáramos con Rocío, a la secretaría particular
    del gobernador (justo a un lado del despacho del mandatario), para recibir el pago, con la
    aclaración de que en breve firmaríamos el convenio
    al que hace referencia la factura.

    De manera “anormal” el pago se hizo en efectivo.
    En copia de la factura, mostrada por Rocío, se firmó que el monto fue recibido.

    Después de ocurrido lo anterior, Magaña Álvarez se comprometió,
    al menos en 5 ocasiones, a firmar el convenio 2, acordándolo así en distintas fechas, sin que éste se hubiera
    concretado.

    Por ello, en Libertad de Palabra decidimos suspender la entrega de facturas en la oficina de Magaña Álvarez, en tanto no
    se firmara el convenio que daba sentido al pago de dichas facturas.

    Lejos de cumplir con la firma del convenio 1, se nos informó que el convenio 2 tampoco
    se concretaría, porque se trabajaría igual que en el 2010, por medio de inserciones,
    y que el costo de la plana se vería levemente reducido.

    Sin embargo, tras la edición de la nota “Degrada a mujeres; Enaltece al gobernador”, la publicidad correspondiente a la
    edición Núm. 185, de plano nos fue suspendida sin ningún aviso.

    Con Magaña Álvarez se pretendía aclarar la reducción en el pago del monto de las inserciones, así como concretar ambos convenios, sin que
    haya sido posible verle para exponerle nuestras dudas.

    Lo anterior porque al enviar carta al gobernador, en el que se narran estos hechos,
    Magaña Álvarez ahora ya no nos contesta el teléfono.


    Addendum ...

    Posted 16 Aug 2014 at 6:16 am
  25. a wrote:

    Wow! This blog looks just like my old one! It’s on a completely different subject but it has pretty much the same page layout and design. Excellent choice of colors!


    Addendum ...

    Posted 16 Aug 2014 at 7:32 am
  26. Malinda wrote:

    Wow! In the end I got a blog from where I can really obtain helpful data regarding my study and
    knowledge.


    Addendum ...

    Posted 16 Aug 2014 at 10:04 am
  27. candy crush saga wrote:

    M? relatives always say that ? am wasting my time he?e at
    web, except I know I am getting know-how daily by reading su?h fast?dious a?ticles or reviews.


    Addendum ...

    Posted 16 Aug 2014 at 11:05 am
  28. Dinah wrote:

    Hi there to every one, it’s in fact a pleasant for me
    to pay a quick visit this web site, it contains valuable Information.


    Addendum ...

    Posted 16 Aug 2014 at 2:07 pm
  29. seggfej wrote:

    Excellent beat ! I would like to apprentice while you amend your
    website, how could i subscribe for a blog site?
    The account helped me a acceptable deal. I had been tiny bit acquainted of this your broadcast provided bright clear idea


    Addendum ...

    Posted 16 Aug 2014 at 2:12 pm