more like "WordPress 4.8.1 password reset feature lets you set the 'From:' address when an admin email address and server name haven't been explicitly configured".
they claim this is a vulnerability because you could create an account, kill the email address for that account, then hammer the password reset which will bounce an email back to [email protected]. i can't imagine how rate-limiting or filters aren't already mitigating this.
the "stealing an account" part is a long shot that someone would respond to the email rather than clicking on the link.
Well a mailserver could very well be configured to have a quota for an email-account boucing the email if the mailbox is full and replying the whole thread (including the reset link).
But then again, having no rate-limiting whatsoever on a public email-sending action is probably an bad idea to begin with.
However even with rate-limiting if the email address is known a malicious hacker could simply spam the mailbox by conventional means (not using the reset-password action more than once).
more like "WordPress 4.8.1 password reset feature lets you set the 'From:' address when an admin email address and server name haven't been explicitly configured".
they claim this is a vulnerability because you could create an account, kill the email address for that account, then hammer the password reset which will bounce an email back to [email protected]. i can't imagine how rate-limiting or filters aren't already mitigating this.
the "stealing an account" part is a long shot that someone would respond to the email rather than clicking on the link.
Well a mailserver could very well be configured to have a quota for an email-account boucing the email if the mailbox is full and replying the whole thread (including the reset link).
But then again, having no rate-limiting whatsoever on a public email-sending action is probably an bad idea to begin with. However even with rate-limiting if the email address is known a malicious hacker could simply spam the mailbox by conventional means (not using the reset-password action more than once).