CVE-2009-2762

This is a vulnerability writeup for CVE-2009-2762, detailing an authentication bypass in WordPress <= 2.8.3 that allows an attacker to reset the admin password by submitting an array to the key variable.

This exploit targets a vulnerability in WordPress 2.6.1 to take over the admin account by abusing the password reset mechanism and predicting the random seed used for password generation. It registers a new admin user, triggers a password reset, and brute-forces the seed to compute the new password.

This exploit leverages SQL column truncation in WordPress 2.6.1 to create a duplicate admin account by registering a username with trailing spaces, allowing password reset via the lost password feature.