A weakness has been discovered in WordPress, which can be exploited by malicious people to identify valid user accounts.

Different error messages are returned depending on whether an unsuccessful login attempt is performed with a valid or invalid username.

Also, the product does not block people after a certain amount of failed login attempts.

The weakness is confirmed in versions 2.0.5 and 3.1.1 and reported in version 1.5. Other versions may also be affected.

Solution
Edit the source code to ensure that a single general error message is returned on a failed login. Restrict access to the "wp-login.php" script (e.g. with ".htaccess").

Provided and/or discovered by
jk, Kad, and ^Xecuti0n3r

Changelog
Further details available to Secunia VIM customers

Original Advisory
http://trac.wordpress.org/ticket/1129

Deep Links
Links available to Secunia VIM customers