There is a new WordPress blog software update available that closes a potential security problem. To quote the WordPress.org release note:
[source]WordPress 2.3.3 is an urgent security release. If you have registration enabled a flaw was found in the XML-RPC implementation such that a specially crafted request would allow a user to edit posts of other users on that blog. In addition to fixing this security flaw, 2.3.3 fixes a few minor bugs. If you are interested only in the security fix, download the fixed version of
xmlrpc.phpand copy it over your existingxmlrpc.php. Otherwise, you can get the entire release here.
The release also advises the removal of WP-Forum plugin as that also has a security problem that is being exploited.
If you do not have registration activated then may not need this blog software update. If you do have registration enabled then consider seriously whether or not you need it. If you don’t then disable it. If you do require it then you will need the update.
If you have been installing all the WordPress blog software updates then you will only need to replace the xmlrpc.php file as advised. Otherwise you will need to do the full update.
As I understand the current situation, there will not be a 2.4 upgrade. WordPress will go straight to 2.5 for its next major blog software upgrade.
