How does it actually work? It looks like reset_password needs to get a valid key to be able to get the user's details from the database.

  	$user = $wpdb->get_row($wpdb->prepare("SELECT * FROM $wpdb->users
            WHERE user_activation_key = %s", $key));

How does that line of code retrieve a valid $user? I looked at the bug fix which filters out the $key being an array, and that will prevent you from passing an array, but I don't see how the array gets you over the hurdle above.

I'm guessing that WordPress has user_activation_key set to '' (empty string) when the user hasn't requested a password reset or similar email-confirmed operation. So, it checks to see if it is empty, it isn't and so it checks to find the user(s) who have empty user_activation_key values. It's using a get_row() method which indicates that it will just return one and not an array which would have caused a type error.

UPDATE: yes, user_activation_key is an empty string when WordPress hasn't received a request from a user to do something that would require it to be set.

Nasty stuff. I notice from the code that once user_activation_key has been set it doesn't get reset. So this vulnerability will not work for someone who has previously asked for password reset.

Seems kind of embarrassing, though, as far as bugs go...

so long as your email account isn't hacked either.

If someone has access to your email account, they always have access to your WordPress since that's how the password reset functionality works.