WordPress 2.8.4
As expected, Automattic promptly released WordPress 2.8.4, a security update to the previously mentioned remote admin password reset vulnerability.
Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner. This doesn’t allow remote access, but it is very annoying.
Whether you’ve patched your WP installation as instructed or not, better grab this upgrade immediately. As always, backup before doing so!
Related Posts
- Previous post: Remote admin password reset vulnerability issue in WP 2.8.3 and below
- Next post: A WP.com sneak peek?
