CVE-2017-8295

CVE-2017-8295 is a medium-severity vulnerability affecting WordPress through version 4.7.4, allowing remote attackers to reset arbitrary user passwords. This flaw arises from WordPress's reliance on the Host HTTP header for password reset emails, enabling an attacker to redirect the reset key to a controlled SMTP server under specific conditions. Exploitation requires high attack complexity, as it depends on the victim's email system behavior or prolonged email unavailability. While not listed on CISA's KEV, exploit code is publicly available, and the vulnerability has garnered significant community discussion and media coverage, indicating substantial interest.