WordPress Exploit Allows Admin Password Reset

Posted by Soulskill on Wednesday August 12, 2009 @03:04AM from the probably-the-first-time-most-have-been-changed dept.

Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.

1 of 100 comments (clear)

Min score:

Reason:

Sort:

Dear Slashdot, by Anonymous Coward · 2009-08-12 03:43 · Score: 0, Offtopic

please hide all the elements if the AJAX reply is "Moderated 'Interesting.' 0 points left."
Thank you.
Love,
Your #1 fan.
PS: In "preview," blank lines don't show up between the paragraphs if I'm using 3*CRLF or the
elemenet.
Love,
Your #1 fan.