WordPress <= 2.8.3 Remote Admin Reset Password Vulnerability and the Patch

Posted: August 11th, 2009 | Author: | Filed under: IT Related | Tags: , , , | 6 Comments »

[at the time this entry was posted, this is still a 0day]

[level: medium]

For those who subscribe to Milw0rm’s RSS, you might have read about the WordPress <= 2.8.3 Remote Admin Reset Password Vulnerability earlier.

Let take a look at the vulnerable code in wp-login.php:

line 186:
function reset_password($key) {
    global $wpdb;
    $key = preg_replace('/[^a-z0-9]/i', '', $key);
    if ( empty( $key ) )
        return new WP_Error('invalid_key', __('Invalid key'));
    $user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users WHERE user_activation_key = %s", $key));
    if ( empty( $user ) )
        return new WP_Error('invalid_key', __('Invalid key'));
line 276:
$action = isset($_REQUEST['action']) ? $_REQUEST['action'] : 'login';
$errors = new WP_Error();
if ( isset($_GET['key']) )
    $action = 'resetpass';
// validate action so as to default to the login screen
if ( !in_array($action, array('logout', 'lostpassword', 'retrievepassword', 'resetpass', 'rp', 'register', 'login')) && false === has_filter('login_form_' . $action) )
    $action = 'login';
line 370:
case 'resetpass' :
case 'rp' :
    $errors = reset_password($_GET['key']);
    if ( ! is_wp_error($errors) ) {
...[snip ]...

You can abuse the password reset function, and bypass the first step and
then reset the admin password by submiting an array to the $key

(Laurent Gaffié)

wanna see some PoC?


Hehehe.. ok.. now lets patch it.. change the code in line 188 into the following code

        if(is_array($key)) {
           $key = '';
           return new WP_Error('invalid_key', __('Invalid key'));
	   $key = preg_replace('/[^a-z0-9]/i', '', $key);

Now you are done.

P/S: This is not the official patch from WordPress. So far there is still no patch yet. You can temporarily use this method and please upgrade to the next version of WordPress when the patch is available. If you found that my patch is still vulnerable to this attack, kindly ‘patch’ me in the comment section

Greetz to Laurent Gaffié & Leong Jaan Yeh


  • http://www.milw0rm.com/exploits/9410
  • http://my.php.net/is_array

The information contained within this advisory is supplied “as-is” with no warranties or guarantees of fitness of use or otherwise. I accept no responsibility for any damage caused by the use or misuse of this information.

6 Comments on “WordPress <= 2.8.3 Remote Admin Reset Password Vulnerability and the Patch”

  1. 1 ApoNie said at 3:43 AM on August 12th, 2009:

    rename/delete wp-login.php? 🙂

  2. 2 ApoNie said at 3:48 AM on August 12th, 2009:

    api xbahaya pon, sebab pass baru still email ke email,yang betul.. tapi kalau orang nak khianat, jenuh gak ahh.. huhu…

  3. 3 xanda said at 8:05 AM on August 12th, 2009:

    indeed.. rename pun is one of the option.. tapi delete tu melampau la.. macam mane nak login

  4. 4 DeKaN said at 11:47 AM on August 12th, 2009:

    Aha. Nice.

    Cis Leong terlibat.

  5. 5 Irwan said at 9:02 PM on August 16th, 2009:

    Lu memang pawah la Xanda The Great!

  6. 6 xanda said at 4:31 PM on August 17th, 2009:

    Hehehe… biase ajer

Leave a Reply