CVE-2009-2762: WordPress

High severity, CVSS 7.5. EPSS: 19.6% chance of exploitation in the next 30 days.

wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key[] array variable in a resetpass (aka rp) action, which bypasses a check that assumes that $key is not an array.

Affected products

• WordPress WordPress: up to and including 2.8.3

Published 2009-08-13. Last modified 2026-06-16.