Take it from somebody who lost at least one whole blog entirely from the consequences not upgrading WordPress: Upgrading your installation or patch is essential. So read this from Ian Kallen.
Also what he added by IM yesterday:
| What’s happening is: spammers are taking over blogs, posting link farm links on them, obscuring their human visibility with CSS tricks but the links are still visible to crawlers… |
| All wordpress users that haven’t patched or upgraded to v2.3.3 are vulnerable. |
| WordPress does not auto-update security fixes. |
| …Any help you can provide getting the word out would be a mitzvah |
I added the last link. 
