Summary
generated automatically from NVD dataWordPress 1.5.1.2 and earlier contain a flaw in wp-login.php, where the message variable is not initialized before use. Remote attackers can exploit this to alter the content of the forgotten password e-mail message, which affects the integrity of that message. The issue is rated MEDIUM with a CVSS v2.0 score of 5.0.
NVD description
wp-login.php in WordPress 1.5.1.2 and earlier allows remote attackers to change the content of the forgotten password e-mail message via the message variable, which is not initialized before use.
EPSS · FIRST.org
2.6%probability of exploitation in the next 30 days
Higher than 84% of scored CVEs
EPSS (Exploit Prediction Scoring System) estimates, from observed exploitation activity, how likely a CVE is to be exploited in the next 30 days. It complements CVSS, which measures severity, not likelihood. Score of 2026-10-19, recomputed daily by FIRST.org.
CVSS v2.0 Score
Information
- Published
- 5 juil. 2005
- Updated
- 16 juin 2026
- Status
- Modified
- Source
- cve@mitre.org
Affected products
Weaknesses (CWE)
References (6)
- http://secunia.com/advisories/15831PatchVendor Advisory
- http://secunia.com/advisories/15831PatchVendor Advisory
Similar CVEs
Other vulnerabilities of type
Monitor your products
Get automatic alerts for every new CVE affecting your equipment.