Simon Willison’s Weblog

SANS WMF Exploit FAQ. This is really good.