A Saudi guy was trying to hack my website… Of-course, due to my knowledge of security, his attempts were not successful. But he reminded me of the method, thus I am posting it to help other WordPress users to secure their blogs.
Simply he tries to reset the password using wordpress lostpassword function.. I will not post the details of the method, so people don’t try it on other blogs..
However, if you maintain a wordpress blog, you can disable the function using a simple plugin:
<?php
/*
Plugin Name: Disable Lost Password Feature
Plugin URI: http://www.almahdi.cc
Description: This is a plugin to disable Lost password feature in wordpress. I have found this plugin online and I can’t recall the source or the author.
Author: Unknown, Posted by Ali Almahdi
Version: 0.1
Author URI: http://almahdi.cc
*/
function disable_password_reset() { return false; }
add_filter ( ‘allow_password_reset’, ‘disable_password_reset’ );
function remove_password_reset_text ( $text ) { if ( $text == ‘Lost your password?’ ) { $text = ”; } return $text; }
function remove_password_reset() { add_filter( ‘gettext’, ‘remove_password_reset_text’ ); }
add_action ( ‘login_head’, ‘remove_password_reset’ );
function remove_password_reset_text_in ( $text ) { return str_replace( ‘Lost your password</a>?’, ‘</a>’, $text ); }
add_filter ( ‘login_errors’, ‘remove_password_reset_text_in’);
?>
Upload to plugins directory and enable in the plugins… This will protect you from lost-password attacks.