WordPress 2.1.1 dangerous, Upgrade to 2.1.2
Long story short: If you downloaded WordPress 2.1.1 within the past 3-4 days, your files may include a security exploit that was added by a cracker, and you should upgrade all of your files to 2.1.2 immediately.
Context & Ripple Effects
WordPress shipped version 2.1 only weeks ago — blog analysis of the release ran in late January 2007 — so the 3–4 day window of poisoned downloads lands right at the peak moment when sites were upgrading to it. This is the project's own distribution channel being hit, not a plugin or a user site.
The team's response echoes its earlier pattern of fast correction under public scrutiny, such as cleaning up its RSS feed validation after criticism in October 2005 — though that episode was about quality feedback, whereas this is an adversary inside the release pipeline.
First-order effects
- Anyone who downloaded WordPress 2.1.1 in the past 3–4 days is running files with an attacker-added exploit and must replace every file with 2.1.2 immediately — a full re-install, not a patch.
- WordPress's maintainers must treat their own servers as potentially compromised, since the exploit entered through files served by the project itself.
Second-order effects
- Hosting providers and consultants running mass WordPress installs face a triage problem: identifying which client sites pulled 2.1.1 during the window and forcing upgrades before the backdoor is exploited.
- Trust in the download mirror becomes a support burden — users who upgrade on schedule now have to verify that the official channel is clean, shifting verification work onto every site operator.
Third-order effects
- If attackers treat upstream distribution channels as targets, open-source projects need signed releases and verifiable checksums as table stakes rather than best practice — the integrity of the tool matters as much as the code in it.
- For a platform whose install base was growing rapidly in 2007, a single compromised release demonstrates that its update mechanism doubles as a systemic risk vector for the whole ecosystem.
The trend: Open-source web platforms are becoming targets of supply-chain attacks aimed at their own distribution channels, making release-integrity verification a core requirement alongside feature updates.