"Login details" spam sent by from the account registration page

[cweiske]

Wordpress sites with open registration are used to spam me.

I am getting mails from WordPress installations that look like this:

Subject: [Legit site] Login Details

Username: www.spammer.example.com - 1.2342 BTC

To set your password, visit the following address:

https://legitsite.example.net/wp-login.php?login=www.spammer.example.com%20-%201.2342%20BTC&key=oSxUtw01QIFHoxHvokfd&action=rp

https://legitsite.example.net/wp-login.php

There are two problems:

1. The username allows spaces, which means the spammer can enter a domain name and a custom text
2. E-Mail clients autolink domains beginning with "www.", which is why all the 50+ registration spam mails I got have user names beginning with "www."

Two things should be fixed here by WordPress:

1. Reject usernames with spaces
2. Reject usernames that have "www." in them, because that causes the e-mail clients to autolink the URL