Four-year-old comment security bug affects 86 percent of WordPress sites (Ars Technica)

> I was trying to think of situations where the attacker doesn't have to be a user on the vulnerable site (in order to get through your only-over-vpn or ssl auth defense).

Oh. I see.

> I could imagine a site you might run that only you can sync your phone to and only you can browse that data, but it could easily show id3v2 tags in your mp3s, and fail to strip the HTML in them, so that looking at a malicious mp3 might induce you to reconfigure the site.

Well.. In this particular vulnerability you would still be vulnerable if in combination with the improper input validation the wordpress site created forms in a predictable manner, thus opening you up to a cross site scripting attack.

IIRC one of the more unfortunate 'features' of http auth is that if your browser is logged into a particular website then that means everything that your browser does can potentially access that website. So any client side scripting going on can then just 'hijack' a existing ssl/http-auth session.

So, obviously this is not fool proof 100% protection.