Description
WordPress is prone to a security bypass vulnerability because it fails to adequately restrict access to the password reset feature. An attacker can exploit this issue to reset the administrator password of the application. Repeated attacks may allow the attacker to cause persistent Denial of Service conditions. WordPress version 2.8.3 is vulnerable; prior versions may also be affected.
Remediation
Update to WordPress version 2.8.4 or latest
References
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0114.html
http://blog.sucuri.net/2009/08/wordpress-2-8-3-remote-admin-reset-password.html
http://packetstormsecurity.org/files/view/80258/wordpress-adminreset.txt
Related Vulnerabilities
Oracle Database Server CVE-2014-4293 Vulnerability (CVE-2014-4293)
WordPress Plugin Bulk Creator Cross-Site Scripting (1.0.1)
WordPress 4.2.x Multiple Vulnerabilities (4.2 - 4.2.14)
WordPress Plugin GeoDirectory Location Manager Multiple SQL Injection Vulnerabilities (2.1.0.9)
Ruby on Rails URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2021-22881)