> Well, after several years not much went wrong. You're talking about whether something has gone wrong with the auto-update system, specifically. However, the

> Well, after several years not much went wrong. You're talking about whether something has gone wrong with the auto-update system, specifically. However, the parent comment was referencing the risk inherent in granting a PHP application write permissions on its own files. Doing so means that almost any exploit in the application can result in persistence, because malware can be written into (hidden in) core Wordpress files. You would not necessarily know how often this happens, because it happens to individual sites. The Wordpress community decided that the risk of not patching quickly outweighed the risk of allowing Wordpress to write its own files. I happen to agree with them; unpatched vulnerabilities are like candy for script kiddies and fall easily to automated attacks. And most people running Wordpress are not sophisticated. That said, for teams that are on the ball about managing updates, running Wordpress with locked down filed/directory permissions is definitely more secure.