Description
WordPress is prone to a security bypass vulnerability because it fails to adequately restrict access to the password reset feature. An attacker can exploit this issue to reset the administrator password of the application. Repeated attacks may allow the attacker to cause persistent Denial of Service conditions. WordPress version 2.8.3 is vulnerable; prior versions may also be affected.
Remediation
Update to WordPress version 2.8.4 or latest
References
http://archives.neohapsis.com/archives/fulldisclosure/2009-08/0114.html
http://blog.sucuri.net/2009/08/wordpress-2-8-3-remote-admin-reset-password.html
http://packetstormsecurity.org/files/view/80258/wordpress-adminreset.txt
Related Vulnerabilities
WordPress Plugin Social Share Icons & Social Share Buttons Security Bypass (2.4.5)
concrete5 CVE-2020-14961 Vulnerability (CVE-2020-14961)
WordPress 4.6.x Cross-Domain Flash Injection Vulnerability (4.6 - 4.6.9)
WordPress Plugin Tutor LMS-eLearning and online course solution Multiple Vulnerabilities (1.7.6)
WordPress Plugin Protected Posts Logout Button Security Bypass (1.4.5)