Hacker News Reader

As I understand - the issue is that WordPress allows in-browser editing of PHP code.

If you only allow people to edit standard HTML, then this issue would go away.

That's not the issue here -- the worm doesn't require any files to be writable.

ah, thanks for the info!