OK, thanks to Brian Layman who did some additional detective work, it turns out there’s a beta release available to plug the security issue. I haven’t installed it yet since I’m not in the position of being seriously compromised by having lots of registered users or comment activity, but for those WordPress bloggers with bigger setups or who don’t want to use the workaround, there are beta versions of WP 2.0.4 (which itself looks to have a stable release out in a few days, which is what I’m waiting for). Check Brian’s article for the latest beta downloads, it looks like they’re being pretty frequently updated right now.