MalwareTeks Blog

Somebody managed to hack into the Wordpress server and modified two files in WordPress v2.1.1 to include code that would allow for remote PHP execution. Although not all downloads of v2.1.1 were affected, WordPress.org has declared the entire version dangerous and has released version 2.1.2 that includes minor updates and entirely verified files.

WordPress Article: WordPress 2.1.1 Dangerous, Upgrade

EDIT (4 March 7:28 PM): WordPress reports that the v2.1.2 code base is clean and in fact the below code is included by the developers in all copies of index.php in the WordPress package.

EDIT: It would appear that someone has successfully hacked Version 2.1.2 and has modified index.php

<?php
// Silence is golden.
?>

STATEMENT REMOVED ~ SPD ~

Reference: Wordpress 2.1.2 download package hacked