Description

WordPress is prone to a security bypass vulnerability because it fails to adequately restrict access to the password reset feature. An attacker can exploit this issue to reset the administrator password of the application. Repeated attacks may allow the attacker to cause persistent Denial of Service conditions. WordPress version 2.8.3 is vulnerable; prior versions may also be affected.

Remediation

Update to WordPress version 2.8.4 or latest

References

http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0114.html

http://blog.sucuri.net/2009/08/wordpress-2-8-3-remote-admin-reset-password.html

http://packetstormsecurity.org/files/view/80258/wordpress-adminreset.txt

http://secunia.com/advisories/36237

Related Vulnerabilities

MySQL CVE-2020-2853 Vulnerability (CVE-2020-2853)

MySQL CVE-2018-3162 Vulnerability (CVE-2018-3162)

OpenSSL Resource Management Errors Vulnerability (CVE-2014-3506)

e107 Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-2099)

WordPress 4.6.x Cross-Site Request Forgery (4.6 - 4.6.13)

Severity

High

Classification

CVE-2009-2762 CWE-255 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Tags

Missing Update Authentication Bypass