CVE-2009-2762
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for...
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
Exploit likelihood
What each source reports
NVD Score used
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
CVE-2009-2762- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-255
- Updated
- 2026-11-02
CVE List No score
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
CVE-2009-2762- Updated
- 2026-11-02
EUVDEUVD-2009-2752 No score
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
EUVD-2009-2752- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fxw5-28xr-82fm No score
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for...
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
GHSA-fxw5-28xr-82fm- Updated
- 2026-11-02
OSV No score
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
CVE-2009-2762- Updated
- 2026-11-02
OSVDEBIAN-CVE-2009-2762 No score
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.
- Record
DEBIAN-CVE-2009-2762- Updated
- 2026-11-02
Affected products
Affected packages
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | WordPress Core 2.6.1 - SQL Column Truncation | 2008-09-07 |
| Exploit-DB | WordPress Core 2.6.1 - Admin Takeover (SQL Column Truncation) | 2008-09-10 |
| Exploit-DB | WordPress Core 2.8.3 - Remote Admin Reset Password | 2009-08-11 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-2762 is a high vulnerability (CVSS 7.5) in Wordpress, published August 13, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 19.6%, the 97th percentile. Fixed in wordpress 2.8.3-2.