Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
Solution:
The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
| Link | Tags |
|---|---|
| https://wpreset.com/changelog/ | release notes vendor advisory |
| https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-authenticated-database-reset-vulnerability | third party advisory |
| https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/ | third party advisory exploit |