WordPress now invalidates the links in a password reset email if the user remembers their password, logs in, and changes their email address.
See https://wordpress.org/news/2014/11/wordpress-4-0-1/
This vulnerability affects the following application versions:
- WordPress 3.1
- WordPress 3.1.1
- WordPress 3.1.2
- WordPress 3.1.3
- WordPress 3.1.4
- WordPress 3.2
- WordPress 3.2.1
- WordPress 3.3
- WordPress 3.3.1
- WordPress 3.3.2
- WordPress 3.3.3
- WordPress 3.4
- WordPress 3.4.1
- WordPress 3.4.2
- WordPress 3.5
- WordPress 3.5.1
- WordPress 3.5.2
- WordPress 3.6
- WordPress 3.6.1
- WordPress 3.7.1
- WordPress 3.7.2
- WordPress 3.7.3
- WordPress 3.7.4
- WordPress 3.8
- WordPress 3.8.1
- WordPress 3.8.2
- WordPress 3.8.3
- WordPress 3.8.4
- WordPress 3.9
- WordPress 3.9.1
- WordPress 3.9.2
- WordPress 4.0