I understand that it’s possible for someone to maliciousy log in as an administrator in Simple Forum 2.0.  Unfortunately, I’ve been having some problems figuring out how to upgrade to 2.1. 

I’ve removed the login bar from my forum and there is currently no way for a user to register or login (I allow unregistered guests to post).  Does this solve the vulnerability in 2.0, or could a hacker still log in as an administrator somehow?

Thanks for the help! 

Honestly, the answer is embarassing: I simply don’t know how to upgrade.  I’m still a bit green when it comes to using my hosting service.  In order to instal the Simple Forum plugin on my host, I had to manually recreate every single folder present in the download and, in turn, upload every single file into the proper folders.  It took a very long time!

The only way I know to upgrade is to replace every single file with the new files from the update, which would take a great deal of time.  This simply doesn’t appeal to me, although I suppose I could do it if I have to.

I also am very nervous that I will screw something up if I try to upgrade and that my forum will be destroyed.

I do need to know, however, if this upgrade is absolutely necessary to keep my site safe.  I have to admit that I’ve started making a great deal of advertising money on my site, and Simple Forum is one of the reasons why.  I can’t put this income in jeopardy by ignoring a necessary upgrade!

I do love the way the forum runs exactly as it exists on my site, however, and wish I could just let it remain the way it is.

So, what do you think?  Am I taking too much of a risk my not upgrading, or would I be safe leaving things the way they are?

Thanks again.  

Maybe just to expand on that… it is a matter if simply dropping the ’simple-forum’ folder from the new version into the ‘plugins’ folder on your server and overwriting.

having said that… there is also a ‘patch’ file which I recommend taking which then replaces a small number fo files with updates and you will need to just check the Avatars location (see the notes with the upgrade). 2.1 needs to moive it to an ew location and tries to copy the defaults. For many systems, permissions will not allow it so it needs to be done manually after the install.