I've been reading around and noticed that WordPress 4.0 has a CSRF vulnerability in the wp-login.php file (https://wpvulndb.com/vulnerabilities/7691). It allows users that make the authenticated user visit a HTML file change the password for the authenticated user. As I've been running WordPress 4.0 for a while myself, I have now upgraded it and put it on localhost to try and test this vulnerability as I wanted to see how hard it actually would be to get in.
Now I have struggled across two questions: There is always a key generated at the password reset, how is that even bypassed? Plus, wouldn't I receive an email to confirm the password change?
I've tried to 'exploit' or use this vulnerability to reset the password of my own account. I created a post form, but that didn't work - always getting "you must be authenticated" - no matter what I do.
Can someone direct me to the right direction? Or provide an example? That would be really appreciated, as I don't see a way to create that on my own. I just want this for testing purposes to know the impact and if it would work at all.