Wordpress vulnerability: Remote admin password reset

It's worth noting that this has already been patched on trunk and the latest stable branch (2.8), so if you run svn update now you'll get this fix.

http://core.trac.wordpress.org/timeline

The patches there are also more extensive. I would recommend getting it direct from the WordPress svn repository rather than using random third-party patches.

There's a more extensive discussion on this thread, linking to the report rather than someone's repost of it:

http://news.ycombinator.com/item?id=755106