Description
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 2.8.3-2 | — |
| Debian 13 | wordpress | 2.8.3-2 | — |
| Debian 12 | wordpress | 2.8.3-2 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 3
- WordPress Core 2.8.3 - Remote Admin Reset Password EDB-9410 · webapps · Aug 11, 2009 · verified
- WordPress Core 2.6.1 - Admin Takeover (SQL Column Truncation) EDB-6421 · webapps · Sep 10, 2008 · verified
- WordPress Core 2.6.1 - SQL Column Truncation EDB-6397 · webapps · Sep 7, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://wordpress.org/development/2009/08/2-8-4-security-release/
- http://core.trac.wordpress.org/changeset/11798
- 9410 exploit
- wordpress-wplogin-security-bypass(52382) vdb-entry
- 20090810 WordPress <= 2.8.3 Remote admin reset password mailing-list
- 36014 vdb-entry
- 1022707 vdb-entry
- 36237 third-party-advisory