WordPress: Security Alert

[greg4god]

http://blogs.zdnet.com/security/?p=4002

Researchers are sounding the alarm for a serious administrator password-reset vulnerability affecting the latest version of WordPress, the popular open-source blog publishing platform.

The flaw, which can be exploited via the browser, gives an attacker a trivial way to compromise the admin account of any WordPress of WordPress MU (multiple user) installation.

see http://seclists.org/fulldisclosure/2009/Aug/0113.html for details of it.

IMO, until there is a fix for this, prevent that code from executing in that section, see the second link above for location of code:

case 'resetpss': 
case 'rp':

    die ('Due to technical issues with WordPress, please contact the administrator to reset your password.');

     .... (the code that is normally in here) ...
    
    break;

-Greg

[waynehoskins]

Thanks for the heads up! I just implemented your patch.

[greg4god]

Not sure how final this is, but here a fix that may do it:

http://core.trac.wordpress.org/changeset/11798

[blonborg]

Greg, thanks for the heads up!

Originally Posted by greg4god

Not sure how final this is, but here a fix that may do it:

I implemented the fix on one site, then upgraded the other from 2.7x to 2.83 and applied the fix. In the meantime, Wordpress has released 2.84.

Bill