All self-hosted WordPress-powered blogs must upgrade to the latest version to avoid an ongoing attack. WordPress.org hosted blogs are not affected.