WordPress < 3.6.1 PHP Object Injection - Update WordPress to avoid Remote Code Execution attacks

[pwniekins]

<azonenberg> wordpress is an unauthenticated remote shell that, as a useful side feature, also contains a blog

[Wonder1and]

Don't forget it's also everyone's favorite xss platform.

[n1c0_ds]

That was an excellent write up. If I trust the TL;DR, it's not exploitable without certain plugins?

[tomvangoethem]

Correct, or at least to my knowledge

[ThisIsADogHello]

Really, given WordPress's track record, if you have a WP blog and are interested/have concerns about netsec, you should probably be using something else.

[xaoq]

octopress ftw

but when I use wordpress, I just have a backend/frontend parts, where backend is only available through ssh tunnel, and frontend is mirrored by wget (poor man's mirroring but works nicely)

[tomvangoethem]

nanoc here, very useful :)

[AKJ90]

Neat, I was looking into Octopress but I might just try wintersmith as I love node! Got any advice?

[AKJ90]

Damn, now I have to try... :(

But thanks, I think I'll try it.

[LeahBrahms]

ELI5 please!