Slashdot Mirror

← Back to Stories (view on slashdot.org)

WordPress Exploit Allows Admin Password Reset

Posted by Soulskill on from the probably-the-first-time-most-have-been-changed dept.

Multiple readers have sent word of a vulnerability in WordPress 2.8.3 which allows anyone to lock an admin out of his or her account by resetting the password. "The bug ... is trivial to exploit remotely using nothing more than a web browser and a specially manipulated link. Typically, requests to reset a password are handled using a registered email address. Using the special URL, the old password is removed and a new one generated in its place with no confirmation required." An alert on the Full Disclosure mailing list detailed the vulnerability, and WordPress quickly rolled out version 2.8.4 to address the issue.

6 of 100 comments (clear)

  1. Clarification by Jugalator · · Score: 4, Informative

    For those who don't RTFA, this doesn't give the attacker access to the new, reset, password. That requires access to the admin's mailbox as well. So the link saying "lock an admin out" is a bit, well, not completely true. It could be true if his/her inbox is hacked, but not otherwise.

    --
    Beware: In C++, your friends can see your privates!
    1. Re:Clarification by Jellybob · · Score: 4, Insightful

      Using the special URL, the old password is removed and a new one generated in its place with no confirmation required.

      While you're right in saying the attacker can't access the admin's account, the admin themselves also can't access it, because their password has already been reset to something else, and they'll have to get the new one. It seems more like a minor inconvenience to me, then a massive bug which will end the world, but still a flaw.

    2. Re:Clarification by evanbd · · Score: 5, Insightful

      If I write a script that resets your password every 3 seconds, you'll find it to be more than a minor inconvenience.

    3. Re:Clarification by Thaelon · · Score: 4, Funny

      Why wait 3 seconds?

      while true; do lynx -dump <specially crafted URL>; done &

      --

      Question everything

  2. Full disclosure a day after discovery? by SmitherIsGod · · Score: 4, Interesting

    Is that not a bit soon? Especially with wordpress - it's going to be ages before many people update, and it's not a critical problem.

  3. That's why I stopped using Wordpress by krovisser · · Score: 4, Insightful

    I was tired of constantly having security issues and having to upgrade. Isn't there less feature-filled blog app out there that's all lightweight and whatnot?