Yesterday, WordPress 2.6.2 was released to address the SQL Column Truncation and mt_rand() vulnerabilities. This release also includes a few other minor bug fixes. (Details of other bug fixes can be found here)

Here’s an excerpt from the WordPress blog to give you an idea on how the vulnerabilities can be used to attack blogs with open user registration.

With open registration enabled, it is possible in WordPress versions 2.6.1 and earlier to craft a username such that it will allow resetting another user’s password to a randomly generated password. The randomly generated password is not disclosed to the attacker, so this problem by itself is annoying but not a security exploit. However, this attack coupled with a weakness in the random number seeding in mt_rand() could be used to predict the randomly generated password.

If you implement open user registration on your blog, then you definitely have to update to WordPress 2.6.2 immediately. Although this is not a very serious security risk, if you don’t update your WordPress installation there’s a possibility that someone would use this vulnerability and be able to guess the generated password, gain access to your blog and mess it up. You wouldn’t want that to happen don’t you?

By the way for those of our friends who are new to WordPress and aren’t sure whether their blogs have open user registration or not, here’s how you can check: In your WordPress dashboard, go to Settings and under the General tab look for Membership options. If the “Anyone can register” option has a check on it then it means your blog is using open user registration. To disable it, just uncheck it and click on the Save Changes button below.

If you don’t have open user registration on your blog and don’t mind spending time doing an upgrade, then go ahead. Nothing wrong with keeping your WordPress installation up-to-date. Personally, I’d rather wait for WordPress 2.7 which is schedule to be released in November unless of course there’s a security release like WordPress 2.2.3, then I’d most certainly do an upgrade.

JaypeeOnline is supported by its audience. When you click on the advertisements or purchase through links on our site, we may earn an affiliate commission. Learn more



Owner and editor of JaypeeOnline. Self-proclaimed geek. New media writer and consultant. WordPress advocate. Loves blogging, gadgets, video games and sports. You can follow him on Facebook or Twitter.


  • JP Habaradas, September 12, 2008 @ 2:45 AM

    @Joie – I’m still thinking whether to update to WP 2.6.2 or not since I don’t have open user registration. Most likely I’ll just wait for WP 2.7 which I’ll be talking about in one of my next posts. :)

  • joie, September 12, 2008 @ 2:42 AM

    I havent updated to 2.6.2 yet.. Im waiting for you to update.. :) anyhow thanks for the information.

  • JP Habaradas, September 10, 2008 @ 7:55 PM

    @jhay – Its mandatory for blogs using open user registration to update to WP 2.6.2. Better safe than sorry. :)

  • jhay, September 10, 2008 @ 7:50 PM

    Had this fixed once the new version came out. Two of the WP blogs I maintain have open registration and it’s just prudent and wise to update ASAP. :wink:

    jhays last blog post..Friendster Blogs 2.0 – now powered by WordPress

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.