WordPress Core < 2.8.4 - Forced Password Reset

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Core < 2.8.4 - Forced Password Reset
7.5
Authorization Bypass Through User-Controlled Key
CVE CVE-2009-2762
CVSS 7.5 (High)
Publicly Published August 12, 2009
Last Updated January 22, 2024

Description

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

References

Share

Vulnerability Details for WordPress

WordPress

Software Type Core
Patched? Yes
Remediation Update to version 2.8.4, or a newer patched version
Affected Version
  • <= 2.8.3
Patched Version
  • 2.8.4

Recent vulnerabilities in WordPress

WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal
8.1
CVE-2026-87902
Sep 22, 2026
Researcher: Robert Ressl
WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling
7.2
CVE-2026-93485
Sep 17, 2026
Researcher: Rafie Muhammad
WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break
3.7
CVE ID Unknown
Sep 17, 2026
Researcher: Jeremy Felt
WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data
4.4
CVE ID Unknown
Sep 17, 2026
Researcher: Jeremy Felt
WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: Paulos Yibelo
WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite)
2.7
CVE ID Unknown
Sep 17, 2026
Researcher: Jesse McNeil
WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: Anthropic
WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass)
5.5
CVE ID Unknown
Sep 17, 2026
Researcher: Ben Bidner
WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: viridis
WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions
4.3
CVE ID Unknown
Sep 17, 2026
Researcher: hermanhms
# Title CVE ID CVSS Researchers Date
1 WordPress Core <= 7.1.1 - Unauthenticated Local File Inclusion via locate_template() Path Traversal CVE-2026-87902 8.1 Robert Ressl September 22, 2026
2 WordPress Core <= 7.1 - Unauthenticated Stored Cross-Site Scripting via wpautop() Blockquote Handling CVE-2026-93485 7.2 Rafie Muhammad September 17, 2026
3 WordPress Core <= 7.1 - HTML API set_modifiable_text() Comment Boundary Break 3.7 Jeremy Felt September 17, 2026
4 WordPress Core <= 7.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Custom Header Image Data 4.4 Jeremy Felt September 17, 2026
5 WordPress Core <= 7.1 - Forced Theme Install/Preview and Selector Injection via Theme Installer Route 4.3 Paulos Yibelo September 17, 2026
6 WordPress Core <= 7.1 - Authenticated (Administrator+) Missing Authorization to Network Plugin Activation (Multisite) 2.7 Jesse McNeil September 17, 2026
7 WordPress Core <= 7.1 - Authenticated (Contributor+) Path Traversal via REST Templates Controller 4.3 Anthropic September 17, 2026
8 WordPress Core <= 7.1 - Missing Authorization to customize_changeset Write via XML-RPC (Multisite/Custom Role edit_css Bypass) 5.5 Ben Bidner September 17, 2026
9 WordPress Core <= 7.1 - Authenticated (Author+) Missing Authorization to Comment/Note Reparenting via REST API 4.3 viridis September 17, 2026
10 WordPress Core <= 7.1 - Authenticated (Contributor+) Information Exposure via Sample Permalink AJAX Actions 4.3 hermanhms September 17, 2026
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation