Unauthenticated administrator takeover via password-reset bypass

Privilege escalation in Malware Scanner 4.7.2 and earlier and Web Application Firewall 2.1.1 and earlier grants remote attackers administrator access. The mo_wpns_init() handler passes an existing WP_User object to wp_authenticate_username_password(), which returns it without validating the supplied password and then permits password replacement. No authentication or user interaction is required; a valid administrator username is enough to reset that account's password and take control of the site.