Description
The my_rand function in functions.php in MyBB (aka MyBulletinBoard) before 1.4.12 does not properly use the PHP mt_rand function, which makes it easier for remote attackers to obtain access to an arbitrary account by requesting a reset of the account's password, and then conducting a brute-force attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP Ultimate Email Marketer Multiple Vulnerabilities (1.1.0)
OpenSSL Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2016-2183)
Omeka Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-5100)
WordPress Plugin Lingotek Translation Multiple Cross-Site Scripting Vulnerabilities (1.1.8)