Description

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

Remediation

References

CVE-2009-2762

Related Vulnerabilities

WordPress Plugin CKEditor for WordPress Cross-Site Scripting (4.5.3)

MySQL CVE-2021-2002 Vulnerability (CVE-2021-2002)

Drupal Core 7.x Cross-Site Scripting (7.0 - 7.72)

phpMyFAQ Improper Restriction of Excessive Authentication Attempts Vulnerability (CVE-2017-11187)

OpenSSL Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2015-0292)

Severity

High

Classification

CVE-2009-2762

Tags

Missing Update Known Vulnerabilities