The PHP Security Blog has an update on the front of the new XML-RPC bug that has surfaced - a note about the update of Wordpress to correct the hole.

WordPress 1.5.2 has been released in response to the vulnerabilities. Unfortunately I had to tell the authors, that while they have properly fixed the SQL injection vulnerabilities which I had disclosed to them 26 days before, they have not properly fixed the remote code execution exploit.

With a trivial modification of the published exploit code, it will still work against WordPress 1.5.2. A fix for this has been commited 2 days ago, after I have sent them the necessary code.

Keep an eye out here for other software that uses the XML-RPC interface, and I'll try to keep what updates I find posted...