Authentication vulnerability in Password Reset with Code for WordPress REST API 0.0.15

The Password Reset feature for WordPress’ REST API had a vulnerability in versions up to 0.0.15. Unauthenticated attackers could set a 4-digit code for any user that, if guessed correctly, would allow the attacker to reset the password for that user. By default, each code was only allowed 3 attempts, but there was no limit to the number of codes that could be generated. This reduced the security of the Password Reset feature, since the code generation process used an unsecure random number generator.