Last week, a very serious bug in OpenSSL was disclosed. OpenSSL, a set of open source tools to handle secure communication, is used by most Internet websites. This bug, nicknamed Heartbleed, allowed an attacker to read sensitive information from vulnerable servers and possibly steal things like passwords, cookies, and encryption keys.
Was WordPress.com vulnerable to Heartbleed?
Yes. WordPress.com servers were running the latest version of OpenSSL, which was vulnerable. We generally run the latest version of OpenSSL to enable performance enhancements, such as SPDY, for our users. The non-vulnerable versions of OpenSSL were over two years old.
Has WordPress.com fixed the issue?
Yes. We patched all of our servers within a few hours of the public disclosure.
Has WordPress.com replaced all SSL certificates and private keys?
Yes. Out of an abundance of caution, we have replaced all of our SSL certificates, along with regenerating all of the associated private keys. In addition, our servers support forward secrecy so that even if our private keys were compromised, they could not have been used to decrypt future encrypted traffic.
Will you be forcing me to reset my WordPress.com password?
At this time, we will not be forcing you to change your password.
Should I change my WordPress.com password?
If you want to, you are welcome to change your password. If you are using the same password other places on the Internet, we urge you to change your password and remind you to use unique passwords wherever possible.