WordPress 2.84 fixes Reset Admin Password Vulnerability

[djbaxter]

WordPress <= 2.8.3 Reset Admin Password Vulnerability
by DK
August 11, 2009

An exploit has been released for all current versions of WordPress including WordPress <= 2.8.3.

Laurent Gaffi? who published the finding says:

An attacker could exploit this vulnerability to compromise the admin
account of any wordpress/wordpress-mu <= 2.8.3 ​

From what I can tell the vulnerability allows an attacker to reset the admin user account without having a valid email address. This could certainly be used in a denial of service vulnerability, locking an admin out their site by continually changing the password.

...more

Upgrade to WordPress 2.84 either automatically via your Admin Control Panel or download and manually install WordPress 2.84 here.

 

[grangonzo]

Wow, that's scary. I will upgrade right away.
I doesn't sound good that some p**ck could compromise all my hard work.

Thanks for the info.