UpHeron
All vulnerabilities

WordPress core

CVE-2009-2762

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

Severity
High 7.5
Published
13 Aug 2009
Last changed
16 Jun 2026
Added to UpHeron
17 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
WordPressWordPress core · cpe:a:wordpress:wordpress
  • Every version up to 2.8.3

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2009-2762
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2009-2762