CVE-2017-829501 WordPress 4.7.4潜在的未经授权的密码重置漏洞之前--0day漏洞

WordPress is an open source blogging tool and content management system based on PHP and MySQL. It has many features including a plug-in architecture and a template system.

The WordPress password reset functionality contains a vulnerability which could potentially allow remote, unauthenticated attackers to get hold of the password reset link without previous authentication.

Affected Versions:
WordPress prior to 4.7.4

QID Detection Logic:
This QID depends on BlindElephant engine to detect the version of WordPress installation as active attacks could potentially harm live installations.

Successful exploitation allows an unauthenticated, remote attacker to gain unauthorized access to a targeted users WordPress account.

N/A Workaround:
Customers are advised to enable the UseCanonicalName feature to enforce static SERVER_NAME value.