The other day a susceptability was found: a particularly crafted link can be asked for that would certainly permit an assailant to bypass a protection check to confirm a customer asked for a password reset. Therefore, the very first account without a type in the data source (generally the admin account) would certainly have its password reset and also a brand-new password would certainly be emailed to the account proprietor. This does not permit remote accessibility, yet it is really frustrating.
We repaired this trouble last evening and also have actually been examining the repairs and also trying to find various other troubles ever since. Version 2.8.4 which fixes all known problems is now available for download and also is extremely advised for all individuals of WordPress.