CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
Explanation of Vulnerability in Simple Terms
WP Reset PRO versions up to 5.98 contain an access control flaw that allows authenticated users with low privileges to perform administrative actions they should not have access to. An attacker with a basic user account can read sensitive site data, modify content, and disrupt site availability. The vulnerability requires a valid WordPress login but no additional user interaction.
What an attacker can do
Read sensitive data, modify site content, and disable the site using a low-privilege user account.
Potential impact on your site
Any low-privilege user can perform admin-level actions, compromising data confidentiality, content integrity, and site availability.
Conditions required to exploit
Valid WordPress user account with low privileges (e.g., Subscriber or Contributor role).
Key dates
External resources
Related vulnerabilities
