[wp-trac] [WordPress Trac] #15286: can reset admin password by adminajax.php

[WordPress Trac]

#15286: can reset admin password by adminajax.php
----------------------------+-----------------------------------------------
 Reporter:  rYokiNG         |       Owner:                   
     Type:  defect (bug)    |      Status:  new              
 Priority:  normal          |   Milestone:  Awaiting Review  
Component:  Administration  |     Version:  3.0.1            
 Severity:  critical        |    Keywords:  reporter-feedback
----------------------------+-----------------------------------------------

Comment(by westi):

 I still can't reproduce this.

 As a logged out user the only code which runs for that page request is
 things hooked onto the {{{wp_ajax_nopriv_wp-compression-test}}} action.

 What is the admin password being changed to?

 Have you checked for code in the mu-plugins folder?

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/15286#comment:12>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software