<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>BlogSecurity &#187; News</title>
	<atom:link href="http://blogsecurity.net/category/wordpress/news-2/feed" rel="self" type="application/rss+xml" />
	<link>http://blogsecurity.net</link>
	<description>Always something worth reading...</description>
	<lastBuildDate>Mon, 22 Feb 2010 21:41:28 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>WordPress Install Files Security Risk</title>
		<link>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk#comments</comments>
		<pubDate>Fri, 08 May 2009 13:35:32 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[blog]]></category>
		<category><![CDATA[blogs]]></category>
		<category><![CDATA[security]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=512</guid>
		<description><![CDATA[Jeff Starr over at Perishable Press has discovered a way to hack a WordPress blog in rare cases where the installation files have been left behind and the database is in accessible:

The other day, my server crashed and Perishable Press was unable to connect to the MySQL database. Normally, when WordPress encounters a database error&#8230;
The [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-install-files-security-risk/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>Guvnr 10 Steps to Secure WordPress Video</title>
		<link>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video</link>
		<comments>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video#comments</comments>
		<pubDate>Tue, 03 Mar 2009 00:29:09 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[wordpress security]]></category>
		<category><![CDATA[wordpress whitepaper]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=460</guid>
		<description><![CDATA[Guvnr has released a really detailed article securing a blog using our WordPress Security Whitepaper (which is due for an update soon). The article is titled, &#34;10 tips to make wordpress hack proof&#34;. Has a nice ring to it.
In addition to this, Guvnr has put together a very cool video which takes one through the [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/guvnr-10-steps-to-secure-wordpress-video/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>WordPress Scanner Next-Gen Released</title>
		<link>http://blogsecurity.net/wordpress/wordpress-scanner-next-gen-released</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-scanner-next-gen-released#comments</comments>
		<pubDate>Tue, 03 Feb 2009 00:23:37 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>
		<category><![CDATA[wordpress scanner]]></category>
		<category><![CDATA[wpscan]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=370</guid>
		<description><![CDATA[Here it is!!!
Its been a long and exciting week. Not only are we experiencing the most severe snow in Kent but I&#8217;ve finally managed to role out the massively improved WordPress vulnerability scanner. It can also be accessed using the menu link above, &#8220;WordPress Scanner&#8221;.
It is a complete re-write of the old scanner. I&#8217;ve not [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-scanner-next-gen-released/feed</wfw:commentRss>
		<slash:comments>12</slash:comments>
		</item>
		<item>
		<title>WordPress Security Predictions in 2009</title>
		<link>http://blogsecurity.net/wordpress/wordpress-security-predictions-in-2009</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-security-predictions-in-2009#comments</comments>
		<pubDate>Thu, 15 Jan 2009 10:36:51 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/?p=306</guid>
		<description><![CDATA[
Okay, deep breath, in 2008, we saw Cross-Site Scripting, SQL injection, SQL truncation, Cookie generation weaknesses, Directory Traversal, Arbitrary File Uploads and Cross Site Request Forgery attacks, to name a few?


A mouth full but it made for a very interesting 2008 case study of security developments in a popular open source PHP application.


The WordPress core [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-security-predictions-in-2009/feed</wfw:commentRss>
		<slash:comments>11</slash:comments>
		</item>
		<item>
		<title>WordPress Pwnie Awards</title>
		<link>http://blogsecurity.net/wordpress/wordpress-pwnie-awards</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-pwnie-awards#comments</comments>
		<pubDate>Wed, 13 Aug 2008 15:08:17 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-pwnie-awards/</guid>
		<description><![CDATA[
The Pwnie Awards, an &#8216;annual awards ceremony celebrating and making fun of the achievements and failures of security researchers and the wider security community&#8217;.


It seems like hardly a week goes by without a new vulnerability  in WordPress or one of its many plugins. Many of them are actively being exploited to own popular WordPress [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-pwnie-awards/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>WordPress 2.6 Released</title>
		<link>http://blogsecurity.net/wordpress/wordpress-26-released</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-26-released#comments</comments>
		<pubDate>Mon, 21 Jul 2008 21:57:33 +0000</pubDate>
		<dc:creator>Philipp</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-26-released/</guid>
		<description><![CDATA[
WordPress 2.6 is now available. We have mentioned from of the security improvements in an earlier post. The latest version promises a number of security enhancements as follows:


XML-RPC is turned off by default, but is easy to turn on again. Historically, attacks were possible through the XMLRPC services. We don&#8217;t know how many bloggers use [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-26-released/feed</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>WordPress 2.6 Security Improvements?</title>
		<link>http://blogsecurity.net/wordpress/wordpress-26-security-improvements</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-26-security-improvements#comments</comments>
		<pubDate>Mon, 23 Jun 2008 11:00:06 +0000</pubDate>
		<dc:creator>Philipp</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-26-security-improvements/</guid>
		<description><![CDATA[
WordPress 2.6 plans to have a number of  security improvements. A number of XMLRPC features will be deactivated by default. I doubt they will remove functions such as pingbacks and trackbacks, however, it is something to keep an eye on.


So will this really help secure WordPress in the future?


WordPress have been becoming more security [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-26-security-improvements/feed</wfw:commentRss>
		<slash:comments>9</slash:comments>
		</item>
		<item>
		<title>WordPress 2.5.1 Release Fixes Several Vulnerabilities</title>
		<link>http://blogsecurity.net/wordpress/wordpress-251-release-fixes-several-vulnerabilities</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-251-release-fixes-several-vulnerabilities#comments</comments>
		<pubDate>Mon, 28 Apr 2008 08:30:14 +0000</pubDate>
		<dc:creator>Philipp</dc:creator>
				<category><![CDATA[Advisories]]></category>
		<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-251-release-fixes-several-vulnerabilities/</guid>
		<description><![CDATA[
The First Security- &#038; Bugfix Release of the latest WordPress branch is now available. WordPress do not mention the vulnerabilities fixed on the download page, but BlogSec recommended 2.5 users upgrade ASAP. 

Of all the bugs fixed, two fairly critical security issues were fixed. A Cross-Site Scripting vulnerability and the WP 2.5 Cookie Integrity Protection [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-251-release-fixes-several-vulnerabilities/feed</wfw:commentRss>
		<slash:comments>5</slash:comments>
		</item>
		<item>
		<title>WordPress Whitepaper rev-1.2: New Release</title>
		<link>http://blogsecurity.net/wordpress/wordpress-whitepaper-rev-12-new-release</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-whitepaper-rev-12-new-release#comments</comments>
		<pubDate>Mon, 14 Apr 2008 10:23:47 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-whitepaper-rev-12-new-release/</guid>
		<description><![CDATA[
Great news! We are pleased to announce, to our translators dismay, that we have revised our popular &#34;How to Secure WordPress&#34; whitepaper.


The new revision takes a more hands-on approach making it easier to follow and implement. New sections have been added to cover important topics like Spam and Blog Encryption.


Check out more information at the [...]]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-whitepaper-rev-12-new-release/feed</wfw:commentRss>
		<slash:comments>7</slash:comments>
		</item>
		<item>
		<title>WordPress 2.5 Admin Login SQL Injection Rumour</title>
		<link>http://blogsecurity.net/wordpress/wordpress-25-admin-login-sql-injection-rumour</link>
		<comments>http://blogsecurity.net/wordpress/wordpress-25-admin-login-sql-injection-rumour#comments</comments>
		<pubDate>Mon, 07 Apr 2008 11:03:10 +0000</pubDate>
		<dc:creator>DK</dc:creator>
				<category><![CDATA[News]]></category>
		<category><![CDATA[WordPress]]></category>

		<guid isPermaLink="false">http://blogsecurity.net/wordpress/wordpress-25-admin-login-sql-injection-rumour/</guid>
		<description><![CDATA[
BlogSec received an email yesterday with a rumour that an SQL Injection issue has been found in the Wordress 2.5 admin login screen.


There is currently no evidence to backup this claim, and we have received no further information. As time permits, we will investigate this issue further.
]]></description>
		<wfw:commentRss>http://blogsecurity.net/wordpress/wordpress-25-admin-login-sql-injection-rumour/feed</wfw:commentRss>
		<slash:comments>24</slash:comments>
		</item>
	</channel>
</rss>
