The developers have been working on hardening (securing) the current 2.8 tree of WordPress. The 2.8.5 release this week has a number of changes to this end.
The headline changes in this release are:
- A fix for the Trackback Denial-of-Service attack that is currently being seen.
- Removal of areas within the code where php code in variables was evaluated.
- Switched the file upload functionality to be whitelisted for all users including Admins.
Its recommended that all sites are upgraded to this new version of WordPress to ensure that you have the best available protection.
They also say
If you think your site may have been hit by one of the recent exploits and you would like to make sure that you have cleared out all traces of the exploit then they would recommend that you take a look at the WordPress Exploit Scanner. This is a plugin which searches the files on your website, and the posts and comments tables of your database for anything suspicious. It also examines your list of active plugins for unusual filenames. You can read more about this plugin here – “http://ocaoimh.ie/exploit-scanner/“