We noticed a security vulnerability in WordPress 2.8.3 yesterday (and earlier versions as well) that allowed an attacker to reset passwords of users. While this vulnerability could not be exploited to gain access to the user account (unless access to the email account the password was send to was available as well) it could be used to annoy those users especially when combined with an automated script that would reset the password every seconds or minutes.
A fix was released with the announcement of the vulnerability which consisted of one line of code that had to be edited in the wp-login.php file of the WordPress installation. WordPress installations with the fix are safe from these kinds of attacks.
The WordPress team has nevertheless released WordPress 2.8.4. as a response to the security vulnerability. The new release patches this vulnerability and is a recommended update for every WordPress installation. The WordPress developers are providing additional information about the vulnerability in the announcement post as well.
It was only possible to reset a password of the first user account without a key according to this post which usually is the admin account of the WordPress installation. WordPress is not showing the new version in its interface. This may change in the next hours.
WordPress admins should head over to the WordPress website to download the new version as of now.
Enjoyed the article?: Then sign-up for our free newsletter or RSS feed to kick off your day with the latest technology news and tips, or share the article with your friends and contacts on Facebook or Twitter.Related Articles:
WordPress Remote Admin Password Reset VulnerabilityWordPress 2.6.5 Security Update
WordPress 2.8.6 Security Update
WordPress 3.03 Security Update Released
WordPress 3.3.1 Security Update Available
WordPress is not showing the new version in its interface.
It does, I had upgraded few hours ago. When update notice shows depends on when WP last checked for updates. It is only performed every so often to not waste resources on each admin area load.
Thank you for the information. I have noticed that there is already a new security update for wordpress in my dashboard. I search for the review and I found your site. Thanks again for the helpful information.