According to its self-reported version number, the WordPress application running on the remote web server is 4.7.x. It is, therefore, affected by a flaw in the wp_mail() function within file wp-includes/pluggable.php due to the improper usage of the SERVER_NAME variable, specifically when input from the HTTP Host header is assigned to SERVER_NAME. An unauthenticated, remote attacker can exploit this issue to reset arbitrary passwords by means of a crafted 'wp-login.php?action=lostpassword' request, which is then bounced or resent, resulting in the transmission of the reset key to a mailbox on an SMTP server under the attacker's control.

Note that exploitation of this vulnerability is not achievable in all cases because it requires at least one of the following conditions :

  - The attacker can prevent the victim from receiving any     e-mail messages for an extended period of time (such as     five days).

  - The victim's e-mail system sends an auto-response     containing the original message.

  - The victim manually composes a reply containing the     original message.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

WordPress 2.3.0 - 4.8.3 Unauthorized Password Reset

high Nessus Plugin ID 100028

Version 1.11

Version 1.10

Version 1.11 Feb 18, 2025, 11:54 PM Plugin metadata (CVSS 3 Change AC:H --> AC:L where needed) Plugin Feed: 202502182354
Version 1.10 Jun 5, 2024, 10:55 AM Required Scan configuration ("Enable cgi scanning" set to "True") Plugin Feed: 202406051055