WordPress warns of smart worm attack on blogs

Worm spreads using patched security vulnerability.

WordPress is warning that a smart worm is spreading among its users by exploiting an old security vulnerability.

The company is warning that the worm is spreading and it has only been identified because of flaws in the malware's design.

“This particular worm, like many before it, is clever: it registers a user, uses a security bug (fixed earlier in the year) to allow evaluated code to be executed through the permalink structure, makes itself an admin, then uses JavaScript to hide itself when you look at users page, attempts to clean up after itself, then goes quiet so you never notice while it inserts hidden spam and malware into your old posts,” warned the company in a blog post.

The worm's poor design means that it breaks links on user's page, alerting them to the fact that something is wrong.

The current version of WordPress, version 2.8.4, is immune from the worm and users are being urged to upgrade as soon as possible, sine it is the only way to beat the worm WordPress warns.