August 11th, 2009
Password-reset flaw haunts WordPress admins
Researchers are sounding the alarm for a serious administrator password-reset vulnerability affecting the latest version of WordPress, the popular open-source blog publishing platform.
The flaw, which can be exploited via the browser, gives an attacker a trivial way to compromise the admin account of any WordPress of WordPress MU (multiple user) installation.
Proof-of-concept code demonstrating the problem is publicly available. A patch is currently being prepared for release soon.
Swa Frantzen, an incident handler at the SANS Internet Storm Center has a detailed explanation of the problem.
UPDATE (August 12, 2009): WordPress has shipped a fix for this “very annoying” problem.
Ryan Naraine is a journalist and security evangelist at Kaspersky Lab. He manages Threatpost.com, a security news portal. Here is Ryan's full profile and disclosure of his industry affiliations.
For daily updates on Ryan's activities, follow him on Twitter.
Subscribe to Zero Day via Email alerts or RSS.
