As I was in the process of writing a new blog entry titled “Do You Know Who’s Reading Your Drafts” in response to a recent loophole in the WordPress system, the development team has come out with a brand new update.

In case you were wondering what all the fuss was about, anyone who adds /wp-admin/ to your URL could view the posts that were currently sitting in draft or published with a future date.

Now, this method is truly harmful if you publish your entire post on the front page of the blog as opposed to using the more tag or excerpts because clicking on the permalink would, of course, yield a post not found error.

Without going into too much detail we’ll just say that WordPress is incorrectly checking to see whether a user is an administrator. Using XXXX as an example, you can visit this URL to reveal some of his upcoming posts:

http://www.address.com/index.php/wp-admin/

If a website is not using the FeedBurner redirect plugin all of the future posts will be available through an RSS feed as well. The URL for that would look something like this:

http://www.address.com/?feed=rss2&x=wp-admin/

That would not be good because there are thousands of sites out there that are setup to scrape feeds from websites, and then publish the content to their own site. This would give them easy access to all of your unpublished content.

The fix presented on the site does not work, so it’s highly recommended that you upgrade your WordPress installation, especially if you’re a journablogger (i.e. journalist blogger) and have a lot of posts set to publish in the future. And as an added bonus, you can now easily customize your DB error page if you don’t like the one generated by WordPress.

,