WordPress download enabled remote execution

WordPress 2.1.1 was released as a normal maintenance build on February 21, 2007. Days later, a report to the WordPress security address pointed to strange, highly exploitable code in the official download. The project took the site down and investigated the package.

The attacker had user-level access to a server behind wordpress.org and modified the release file. Two files were changed, and the additions were named to read as WordPress internals: comment_text_phpfilter() in wp-includes/feed.php wrapped eval($_GET["ix"]), and get_theme_mcommand() in wp-includes/theme.php wrapped passthru($_GET["iz"]). The Subversion repository was not touched; the damage was in the generated archive that users trusted.

The project declared all 2.1.1 downloads from the affected window dangerous, even though not every download was necessarily altered. WordPress 2.1.2 followed with verified files, and users were told to overwrite the full tree, especially wp-includes.

The lesson was plain: the release archive is production code. The Subversion history was intact and irrelevant, because nothing verified that the published archive matched it; WordPress had no release signing at the time, which is why the response promised external verification of the download package. WordPress responded with server lockdown, password resets, and external checks of release packages.