wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

WordPress reports :

A specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password would be emailed to the account owner.

The remote host is running a version of WordPress earlier than 2.8.4.  Such versions are potentially affected by a flaw in the 'reset_password()' function of the 'wp-login.php' script which allows an attacker to reset the password for the first account without a key in the database (usually the admin account).

According to its version number, the version of WordPress running on the remote server has a flaw in the password reset mechanism.
Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in the database, which is usually the administrator. A remote attacker can use this to repeatedly reset the password, leading to a denial of service condition.

The version of WordPress hosted on the remote web server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in the database, which is usually the administrator. A remote attacker can use this to repeatedly reset the password, leading to a denial of service condition.

ID	Name	Product	Family	Severity
40583	FreeBSD : wordpress -- remote admin password reset vulnerability (2430e9c3-8741-11de-938e-003048590f9e)	Nessus	FreeBSD Local Security Checks	high
5126	WordPress < 2.8.4 Security Bypass Vulnerability	Nessus Network Monitor	CGI	medium
40578	WordPress < 2.8.4 'wp-login.php' 'key' Parameter Remote Administrator Password Reset (uncredentialed check)	Nessus	CGI abuses	medium
40577	WordPress < 2.8.4 Password Reset	Nessus	CGI abuses	medium

Detections

Analytics

CVE-2009-2762

critical

Tenable Plugins

high

medium

medium

medium