Wordpress 2.8.3 Admin Password Exploit And The Fix

11th August 2009 - 4 minutes read time

A small exploit has been found within the latest (currently 2.8.3) version of Wordpress that can cause any attacker to reset the admin password. The attacker won't be able to see what the password is, and the new password is emailed to you anyway, but it might cause some users to be locked out of their blogs if they can't get access to the email or their email is down. However, it is a real pain so I am writing this blog to allow other bloggers to fix their Wordpress installs.

The Problem

Wordpress allows you to reset the admin password, which some users might want to do. The normal course of events is that the admin user selects that they want to reset their password and Wordpress will email the user a link containing a key. Following this link will reset the admin password. The issue is that it is possible to recreate this link without first sending out the email, which will reset the password. Here is the URL that can be used to reset the password.

http://DOMAIN_NAME.TLD/wp-login.php?action=rp&key[]=

I include this here so that you can make sure that the fix below has worked. Please don't try it out on other people's blogs!

The Solution

The solution is to reject activation keys that are arrays, but in case you don't follow what is going on in this trac report all you need to do is open up the file wp-login.php in the root of your blog and change line 190 from this:

if ( empty( $key ) )

To this:

if ( empty( $key ) || is_array( $key ) )

Upload the file to your site and you are done! You can check that this has fixed the issue by visiting the link above, you will see an invalid link notice.

WordPress

Comments

informative post. I hope you continue writing such informative articles

Submitted by Fix Access on Tue, 03/02/2010 - 14:07

Permalink

Add new comment

The content of this field is kept private and will not be shown publicly.
CAPTCHA
7 + 8 =
Solve this simple math problem and enter the result. E.g. for 1+3, enter 4.
This question is for testing whether or not you are a human visitor and to prevent automated spam submissions.

Related Content

Logging Errors In WordPress

21st June 2011

To debug WordPress many sites will tell you to add the WP_DEBUG setting on its own to your wp-config.php file, but this can be quite harmful as many server configurations will start showing PHP errors and warning messages on your site pages.

Read more

The Correct Way To Load A Template File In WordPress

18th December 2010

Since WordPress 3.0 there has been a funcion called get_template_part(), which has been used quite a bit in the new Twenty Ten default WordPress theme. This is an evolution of the usual way to include parts of themes by using functions like get_header() to include the header.php file.

Read more

Some Essential WordPress Plugins

28th October 2010

I know what you are thinking, but this isn't just another WordPress plugin blog post. I am asked every few weeks what WordPress plugins I would recommend, and I always end up giving a disjointed list of some from the top of my head.

Read more

WordCampUK 2010: A Review

21st July 2010

WordCampUK is an informal 2 day conference and barcamp that centers around using, working with and developing in WordPress. This year's WordCampUK was held in Manchester and so being local I could hardly miss the opportunity to attend. It was a great event, with great talks and lots of friendly people who were really enthusiastic about WordPress.

Read more

Custom Post Types In WordPress 3.0

12th July 2010

This article relates to WordPress 3.0. Much of the code posted here won't work on previous versions and some of the information may change in newer versions.

WordPress already comes with five different content types built into the system.

Posts

Read more