WordPress security and firesheep

wordpress.com is vulnerable if you don’t use https – it gets an F!

Actually, on WordPress.com, just visit Users/Personal Settings in your Dashboard and check “Always use HTTPS when visiting administration pages.”

Technically, anything that doesn’t run over HTTPS or doesn’t provide an HTTPS option “gets an F,” because that’s how Firesheep works.

Are self host wordpress blogs vulnerable too if you dont install a ssl certificate and use https?

Yes, you need to use a secure connection over HTTPS to protect yourself from Firesheep. Follow this guide:

http://codex.wordpress.org/Administration_Over_SSL