A severe shell-execution exploit has been released by rgod (rgod@autistici.org).

The vulnerability affects all versions of WordPress Blog System<=2.0.2.

The good news - the exploit works only for WordPress sites where the "Self User Registrration" (e.g. /wp-register) is enabled, so for now you can "patch" your system disabling the Self User Registration.

I ran some tests and it seems that the exploit really works fine. However if you are using some redirects to the User Profile section of your blog the exploit will not follow them and keep you from lamers that are trying to hack your server without understanding.

The exploit injects code in "cache/userlogins" files, where WordPress stores user infomration in cache files. On successfull exploit the intruder can launch arbitrary commands (with the webserver user) to the remote machine throught malicious URL. In addition the exploit creates a file called "suntzu.php" - a backdoor to your system.

We are waiting for the official patch from WordPress, but for now you SHOULD disable “User Self Registrations” !

Another Solution:
Restrict web access to the wp-content/cache/userlogins/ and wp-content/cache/users/ directories (e.g. with a .htaccess file)
Use this if you have untrusted users in your blog system.

Here’s the code: http://retrogod.altervista.org/wordpress_202_xpl.html