WordPress远程管理重置密码漏洞补丁
该漏洞记录在此处。该补丁据称是1行替换 如此处记录在branches/2.8/wp-login.php第190行中 - 新补丁应该如下所示（检查第 118 行） - 我的问题是 - 这个补丁足够吗？如果没有，有什么建议吗？
The vulnerability is documented here. The patch is supposedly a 1-line replace as documented here in line 190 of branches/2.8/wp-login.php - the new patch should look this (check line 118) - my question is - is this patch enough? If not, any suggestions?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，这是针对 WordPress 漏洞的一个非常好的补丁。
这不是 SQL 注入，如果是，那么您可以转储整个用户表。更改姓名并不是一个很好的安全措施。保持代码最新是您必须始终做的事情，否则您将被黑客攻击。
Yes, this is a very good patch for the Wordpress vulnerability.
This is NOT SQL Injection, if it was then you could dump the entire table of users. Changing your name is not a very good security measure. Keeping your code up to date is what you must always do, or you will be hacked.
据我了解，补丁堵住了那个特定的漏洞。然而，我对我管理的每个 WP 站点采取的另一项基本安全措施是删除“admin”用户，并且最好不要让任何用户的用户名与其显示名称相同。这使得安全性加倍，因为坏人必须猜测用户名，并找出破解密码的方法。
通过搜索 WordPress + 安全性，您可以找到很多额外的安全措施，但我一直坚持更改用户名、更改安装时的数据库表名称以及基本权限等内容。到目前为止，这种方法运作良好，在 WP 升级期间不需要进行大量额外的维护，而某些更严格的安全措施则需要这些额外的维护。
As I understand it, the patch closes that particular hole. However, another basic security measure I take on every WP site I administrate is to delete the "admin" user, and ideally never have any users' usernames be the same as their display names. That doubles the security in that bad guys have to guess the usernames, as well as figure out a way to hack the passwords.
There are a lot of additional security measures you can find by doing a search on WordPress + security, but I have stuck with changing usernames, altering the db table names on install, and basic permissions stuff. That's worked well so far, without the ton of additional upkeep necessary during WP upgrades that some of the more intense security measures require.