Ok Crybabies: 2.8.3 wordpress remote admin password exploit

[fris]

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept

http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=

Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

[CurrentlySober]

I FUCKIN HATE... Poppy Morgan..

[Iron Fist]

So since you can't actually get access, how is this an exploit? Other than pissing off the admin of the site with constant e-mails that his admin password changed.

I can see how this could be annoying however.

[Robocrop]

Great news Fris.

[Hentaikid]

Another reason to delete admin user and use a different username as admin

[tonyparra]

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept



Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

I dont use admin on any wordpress site

[tonyparra]

Before you make posts saying shit please understand this exploit before you go all bananas.

You can reset the admin password without confirmation, but you dont know the password, and unless you have access to the admin email account it does nothing.

http://www.milw0rm.com/exploits/9410

Proof of concept



Already a fix out, so dont cry about having to upgrade all the time, if you dont like the product, dont use it, simple.

fix, edit 1 line of the code

http://core.trac.wordpress.org/changeset/11798

also mr. fris why so serious lets drink man

[The Duck]

Also htaccess protect your admin folder.

[TheSenator]

fixed.....thanks

[fris]

remember it only resets your admin password without confirmation, theirs no way you can know the admin password unless you have access to the admin email, so its not really a exploit, just really unconveinent, cause people will be resettting password, but like i said its fixed.