PT-2020-19356 · WordPress · Wp Database Reset

Chloe Chamberland · Published 2020-01-16 · Updated 2021-07-21 · CVE-2020-7048

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AC:L/AV:N/A:H/C:N/I:H/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier

Description The issue allows any unauthenticated user to reset any table in the database to the initial WordPress set-up state, resulting in the deletion of all site content stored in that table. This can be achieved through the "wp-admin/admin-post.php?db-reset-tables[]=comments" URI, which demonstrates the flaw.

Recommendations For WP Database Reset versions 3.1 and earlier, update to a version that contains a fix for this issue to prevent unauthorized database resets.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-7048

Affected Products

Wp Database Reset

References · 7

• 🔥 https://github.com/ElmouradiAmine/CVE-2020-7048 · Exploit
• 🔥 https://wordfence.com/blog/2020/01/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin · Exploit
• https://osv.dev/vulnerability/CVE-2020-7048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-7048 · Security Note
• https://wordpress.org/plugins/wordpress-database-reset/#developers · Note
• https://t.me/cybersecuritytechnologies/534 · Telegram Post
• https://wpvulndb.com/vulnerabilities/10027 · Note