CVE-2009-2762 is a critical vulnerability affecting WordPress versions 2.8.3 and earlier, allowing remote attackers to force a password reset for the first user, often the administrator. This is achieved by exploiting a flaw in wp-login.php where a crafted key[] array variable in a resetpass action bypasses a security check. The vulnerability has a CVSS score of 7.5, indicating high severity, with a low attack complexity and no authentication required, potentially leading to full compromise (confidentiality, integrity, and availability). Its EPSS score of 0.741 suggests a significant likelihood of exploitation. While not listed on the CISA KEV catalog or having active Metasploit/Nuclei modules, an ExploitDB entry (EDB-9410) specifically details a remote admin reset password exploit for WordPress 2.8.3. Despite this, there is minimal community discussion or media coverage surrounding this CVE.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 2.8.3CPE matchmatch criteria | cpe:2.3:a:wordpress:wordpress:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.