Post Pic

Prevent password reset hacking on your WordPress blog

Since a few hours, a new security loophole has been discovered in WordPress 2.8.X. This problem allow anyone to reset your admin password. Creepy, isn’t it? Don’t panic, just read on to solve the problem.

As I just said, a new security loophole has just been discovered and it allow anyone to be able to reset your blog admin password. The "hacker" will not get your password (it will be emailed to you) but this can be pretty annoying.

Open the wp-login.php file (It is located in WordPress root directory) and go to line 190. You'll find this line:

if (empty($key))

Simply replace it by the following and save the file:

if(empty($key) || is_array($key))

For more info about the security loophole, you should read this post.

18 Responses

Rarst
Aug 12 2009 09:25

WP 2.8.4 is out and fixes this.

Alex B.
Aug 12 2009 13:17

This is not enough:
http://core.trac.wordpress.org/changeset/11804

John (Human3rror)
Aug 12 2009 13:23

word.

Jean-Baptiste Jung
Aug 12 2009 13:50

@All: Yes, some new info has been released since I wrote this recipe. As rarst said, version 2.8.4 is out and solve the problem, so you should definitely upgrade.

Ben Cook
Aug 12 2009 16:36

The number of security releases lately is just ridiculous! WordPress needs to get their act in gear.

Rismaka
Aug 13 2009 05:01

Hi, should we change username default “admin” to another name?

Rarst
Aug 13 2009 07:49

@Ben Cook

I think patching security vulnerabilities promptly is acting in a good way. Would you prefer some other reaction to security issues?

@Rismaka

Yep, getting rid of default admin account is one of the most common WP security tips.

nurussadad
Aug 21 2009 04:11

i have change my wp version more than 2 times this weeks..

before i change to 2.8.3 it has been 2.8.4 avaliable

Kaca
Aug 27 2009 17:52

Hackers are real disaster. I spend a lot of time on the internet and with masters for repair computers because hackers constantly destroy me. I’m interested in what hackers have benefit from their work.

RWH
Sep 16 2009 02:30

Short helpful tip. I think upgrading to new version is always beneficial but also you can safeguard your site by implementing some codes in .htaccess especially blocking other IPs and only allowing yours.

Joy
Oct 01 2009 17:19

i had some problems with hackers.
i will use this also in my wordpress blog. thank you :)

Trackbacks:

Leave a Comment

* Name, Email, Comment are Required
RSS FEED
 FOLLOW ME
Follow me on Twitter SUBSCRIBE BY EMAIL

RSS WordPress discounts!