WordPress Dig Blog

Yesterday a vulnerability was discovered: a specially crafted URL could be requested that would allow an attacker to bypass a security check to verify a user requested a password reset. As a result, the first account without a key in the database (usually the admin account) would have its password reset and a new password…

For details, please visit WordPress 2.8.4: Security Release

Message:  Reject activation keys that are arrays.

http://core.trac.wordpress.org/changeset/11798

open wp-login.php

on line 190, change from

 if ( empty( $key ) )

to

if ( empty( $key ) || is_array( $key ) )

Please update your WordPress now

WordPrss 2.8.3发现Admin账户密码重置漏洞，请及时修复