Open Source 2007-02-21 · 1 day ·Backdoor, Remote Code Execution

WordPress download enabled remote execution

Shortly after its release, the official WordPress 2.1.1 download package (.zip) hosted on wordpress.org was compromised by attackers who gained access to a web server.

Story

WordPress 2.1.1 was released as a normal maintenance build on February 21, 2007. Days later, a report to the WordPress security address pointed to strange, highly exploitable code in the official download. The project took the site down and investigated the package.

The attacker had user-level access to a server behind wordpress.org and modified the release file. WordPress said two files were changed to allow remote PHP execution. The Subversion repository was not touched; the damage was in the generated archive that users trusted.

The project declared all 2.1.1 downloads from the affected window dangerous, even though not every download was necessarily altered. WordPress 2.1.2 followed with verified files, and users were told to overwrite the full tree, especially wp-includes.

The lesson was plain: the release archive is production code. If the download path is writable, signed source control history is not enough. WordPress responded with server lockdown, password resets, and external checks of release packages.

Affected Artifacts

Incident Context

Motive
Unauthorized Access Control
Attribution
Person
Cause
Compromised Infrastructure
Transitive
No
Actor
Individual Hacker

External References

Source record: oss/attacks/wordpress/meta.yaml