3 ms·

The exploit has WordPress change the password and email the new password to the user. You aren't able to get access to someone else's blog through this and the

by mdasen 17y ago

The exploit has WordPress change the password and email the new password to the user. You aren't able to get access to someone else's blog through this and they shouldn't lose access as long as they still have access to the email account (and check it regularly to see that the password has been changed), but it's definitely an annoying bug.

HalcyonMuse 17y ago
Seems kind of embarrassing, though, as far as bugs go...
fname 17y ago
so long as your email account isn't hacked either.
- mdasen 17y ago
  If someone has access to your email account, they always have access to your WordPress since that's how the password reset functionality works.
jgrahamc 17y ago
How does it actually work? It looks like reset_password needs to get a valid key to be able to get the user's details from the database. $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key)); How does that line of code retrieve a valid $user? I looked at the bug fix which filters out the $key being an array, and that will prevent you from passing an array, but I don't see how the array gets you over the hurdle above.
- deleted 17y ago
  [deleted]
- mdasen 17y ago
  I'm guessing that WordPress has user_activation_key set to '' (empty string) when the user hasn't requested a password reset or similar email-confirmed operation. So, it checks to see if it is empty, it isn't and so it checks to find the user(s) who have empty user_activation_key values. It's using a get_row() method which indicates that it will just return one and not an array which would have caused a type error. UPDATE: yes, user_activation_key is an empty string when WordPress hasn't received a request from a user to do something that would require it to be set.
  - jgrahamc 17y ago
    Nasty stuff. I notice from the code that once user_activation_key has been set it doesn't get reset. So this vulnerability will not work for someone who has previously asked for password reset.

by mdasen 17y ago

HalcyonMuse 17y ago

Seems kind of embarrassing, though, as far as bugs go...

fname 17y ago

so long as your email account isn't hacked either.

mdasen 17y ago
If someone has access to your email account, they always have access to your WordPress since that's how the password reset functionality works.

jgrahamc 17y ago

How does it actually work? It looks like reset_password needs to get a valid key to be able to get the user's details from the database. $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key)); How does that line of code retrieve a valid $user? I looked at the bug fix which filters out the $key being an array, and that will prevent you from passing an array, but I don't see how the array gets you over the hurdle above.

deleted 17y ago
[deleted]
mdasen 17y ago
I'm guessing that WordPress has user_activation_key set to '' (empty string) when the user hasn't requested a password reset or similar email-confirmed operation. So, it checks to see if it is empty, it isn't and so it checks to find the user(s) who have empty user_activation_key values. It's using a get_row() method which indicates that it will just return one and not an array which would have caused a type error. UPDATE: yes, user_activation_key is an empty string when WordPress hasn't received a request from a user to do something that would require it to be set.
- jgrahamc 17y ago
  Nasty stuff. I notice from the code that once user_activation_key has been set it doesn't get reset. So this vulnerability will not work for someone who has previously asked for password reset.