beNi released 7 zero-day vulnerabilities for WordPress today as well as a the first weblog worm, which topic has interested me for some time now…

I have shared a few comments with beNi over various WordPress vulnerabilities in the past. He seemed to drop of the face of the planet, but has just launched the first public weblog worm that affects the latest versions of WordPress.

We are hoping to have a chat to him soon about these risks . . . we are also awaiting WordPress’s response when they finally see his work which includes some persistent XSS vulnerabilities.

Although, I don’t know if I agree completely with just blurting out 7 holes in a blog software with 2-3 million users, its great research. Nice work beNi.

All I can say is, ouch!