It probably feels that way to the bloggers using WordPress who have discovered that their sites have become spam buckets, after a worm took advantage of known vulnerabilities in recent versions of the popular blogging software.
We don’t know how many blogs have been compromised, but as blogging journalist Adam Tinworth wrote: “By Saturday, tech celebs from Robert Scoble to Andy Ihnatko got hacked. Twitter was full of the wails of the hacked, and the retweetings of the warning“.
Auttomatic, the company behind WordPress, discovered the latest vulnerability on 11 August and offered a patch the next day. Blogs hosted on WordPress.com are running the latest version of the software and were unaffected.
There is a joke that you know when a site or bit of social media software like WordPress becomes successful when it gets spammed. A positive spin on this worm is that WordPress has become successful enough to warrant the attention of coding malcontents, but for those affected, it’s difficult to find a silver lining when they have to spend hours cleaning up compromised blogs.
Security analyst David Kierznowski at BlogSecurity has a list of more than two dozen known vulnerabilities in all versions of WordPress. A 2007 survey of 50 WordPress by Kierznowski found that only one of the sites was running the latest version of the software, leading him to warn that the WordPress community was vulnerable to attacks. So maybe the question isn’t whether WordPress is more likely to be hacked but whether WordPress users are less likely to upgrade.
Mullenweg told the Guardian: “Our success has definitely brought more people into the community both improving the code and looking for ways to exploit it. It’s unlikely an in-house Cm [content management system] project or smaller software would have the quality or quantity of developers WordPress does, and ‘security through obscurity’ of the code being private is not an effective protection.“
But the anxiety that this attack – one of a number in the past year against WordPress – has engendered may create enough concern for someone to spot the chance to create a rival product. Mullenweg agrees that this is a “unique opportunity“ – though that may be just to tempt people to move to Auttomatic‘s hosted offering. Kevin Anderson