CVE-2009-2762: High severity wordpress vulnerability
Published Aug 13, 2009
·Updated
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Affected Software
1 affected component
WordPress<=2.8.3
Remediation
Event History
Aug 13, 2009
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2009-2762?
CVE-2009-2762 has a high severity level due to its potential to allow unauthorized password resets for the first user.
2
How do I fix CVE-2009-2762?
To fix CVE-2009-2762, you should update to WordPress version 2.8.4 or later.
3
What versions of WordPress are affected by CVE-2009-2762?
CVE-2009-2762 affects WordPress versions 2.8.3 and earlier.
4
What specific vulnerability does CVE-2009-2762 exploit?
CVE-2009-2762 exploits a flaw in wp-login.php that allows attackers to bypass checks and force a password reset.
5
Who can be affected by the exploitation of CVE-2009-2762?
Administrators and the first user in the database can be affected by the exploitation of CVE-2009-2762.