Wordpress blues solved with a worm
Author: Tim NashJust to be clear we are not recommending you use the worm to patch your sites, rather providing information on how the Worm works, as always you should get patches from a known authority such as wordpress.org, that said this vulnerability is out there and the official patch is not.
Just a quick post about mybeni latest idea, its as far as I know the first dedicated XSS worm for wordpress, basically it means that his proof of concept can edit PHP files on your server as well as a range of other nefarious things. But don’t panic to much as his current worm does nothing more then fix the security hole in Wordpress 2.2.1 the irony being it fixes the hole its using.
Might I suggest its probably time to get patching 
Now if you want to use his worm then follow the following steps (Payment Blogger is not responsible for what happens next )
How can I start the Worm?
- Go to your blog and login to your Wordpress Adminstration Panel
- Post a Comment to your own Blog containing a link to this blog, that means http://mybeni.rootzilla.de/mybeNi/
- Go into your admin Panel -> Moderate Comments and click the freaking link :o)
- The friendly worm will guide you through everything and your blog is secure again.
Source:http://mybeni.rootzilla.de/mybeNi/2007/this_is_the_first_weblog_xss_worm/
It won’t be long be for new worms start appearing so patch quickly and early to save yourself from bother.
For more details on the 7 known problems see the full list.
Olaf
from Website Templates2007-08-01 11:16:46
sure this way you’re really quick to fix this security whole, but why not waiting for the official WP patch?
Tim Nash
2007-08-01 11:18:40
note the we are not recommending part
We are simply passing on that a worm exists and while benign now their are sure to be others soon
However you patch make sure you do
Michele
2007-08-01 20:46:56
I love it. What an elegant way to offer help to the WordPress community while showcasing the slow response by WP!
Hopefully, this friendly worm doesn’t turn out to be the next Michelangelo trojan.
Chris
2007-08-02 05:34:40
I would imagine that an update from WP (eg the next version) may wipe out the worm’s update and you would have to run the worm again…
Johnty
from SEO Forensics2007-08-02 08:10:51
Hopefully when Wordpress do their next release the worm won’t work any more and so there will be no need to run it