Wordpress 2.3.3 fixes a few minor bugs and the debatable Wordpress 2.3.2 XMLRPC vulnerability. It took 4 months to track the XMLRPC exploit and 1 days for the patch to be release. Kudos to WordPress Developer especially Ryan & Joseph Scott for these quick security release.

Wordpress 2.3.2 XMLRPC vulnerability patches by josephscott

• xmlrpc.php.diff (0.7 kB) -on 02/02/08 16:53:22.
• xmlrpc.php.2.diff (3.2 kB) - on 02/03/08 04:49:26.
• 2.3-xmlrpc.php.diff (3.2 kB) - on 02/04/08 18:48:23 (2.3.3).

External Links

• Wordpress 2.3.3 Download
• Wordpress Development Blog
• Wordpress 2.3.3 Milestone
• village-idiot.org → WordPress 2.3.3 List of changed files (download available)

This issue has been raised 4 months ago (october 2007). Certainly this is one of BadPress Ticketing Problems. Until WordPress Developer release Official securities fix (v 2.3.2.1 || 2.3.5 ?? ) You might want to try this “debatable” patch by SecuriTeam - Paul (Yabba) Jones.

Note: Matt Mullenweg & the WP-Hackers is against secureTeam “hasty-patch” and their POC release. [wp-hackers] xmlrpc issue or no?.

Excerpt from Wordpress Support Forum » iframe injection problem?

Matt Mullenweg → [...] I would rather not have people think they’re safe and really not be, and there is a release coming shortly anyway. [...]
If anyone is scared and wants a fix NOW, they should either turn off registration (which is off by default) or delete xmlrpc.php. ~ Feb 3, 2008

WordPress 2.3.3 has been release it’s advice not to try this patches

Patch xmlrpc.php via WordPress Admin

1. Login to Wordpress Admin
2. Goto Manage » Files then scroll down to “Other Files” sections, type in xmlrpc.php. otherwise type the following URL in your browser address-bar ↓

   mydomain.com/wp-admin/templates.php?file=xmlrpc.php&submit=Edit+file+%C2%BB

3. Find the following code (around Line 1151 - 1203 ) within wp_xmlrpc_server::mw_editPost() class methods ↓

   if ( ( 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )

4. Replace with

   //if ( ( 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
    if ( ( 1 || 'post' == $post_type ) && !current_user_can('edit_post', $post_ID) )
   

   saved.

5. Disabled New User Registrations for temporary.

External Links

• Wordpress Support Forum → iframe injection problem?
• SecuriTeam → WordPress 2.3.2 XMLRPC Vulnerability POC
• Wikipedia XML-RPC
• Google → Wordpress XML-RPC Vulnerabilities
• PHPXREF wp-trunk xmlrpc source