I only had a quick look at the affected code but it seems an attack would take the following format. 1: Craft a request to trigger a password reset for the adm

I only had a quick look at the affected code but it seems an attack would take the following format. 1: Craft a request to trigger a password reset for the admin account. 2: Then predict the token that would be generated and use this to access the reset and change the password. This would be feasible because the token is predictable if you know the mt seed which is the only random number used in the token generation. Whilst this is not completely straightforward, anyone with access to the machine (including on the same shared host) could easily find out the seed, and of course there are plenty of other vectors for machines leaking this information.