PT-2024-15087 · WordPress · Wp Reset – Most Advanced Wordpress Reset Tool

Justin Kennedy · Published 2024-04-09 · Updated 2024-05-10 · CVE-2023-6799

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress versions up to, and including, 2.0

Description The issue allows unauthenticated attackers to extract sensitive data, including site backups, by brute-forcing snapshot filenames due to insufficiently random snapshot names. The vendor does not plan to do any further hardening on this functionality.

Recommendations For versions up to, and including, 2.0, consider disabling the snapshot functionality until a more secure alternative is available, as the vendor does not plan to release further security enhancements for this feature.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2023-6799

Affected Products

Wp Reset – Most Advanced Wordpress Reset Tool

References · 7

• https://osv.dev/vulnerability/CVE-2023-6799 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071811%40wp-reset&new=3071811%40wp-reset&sfp_email=&sfph_mail= · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-6799 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/68f41e88-ed36-4361-bddd-41495a540cd9?source=cve · Note
• https://t.me/cvenotify/79695 · Telegram Post
• https://plugins.trac.wordpress.org/changeset?old_path=/wp-reset/tags/1.99&old=3059287&new_path=/wp-reset/tags/2.0&new=3059287&sfp_email=&sfph_mail= · Note
• https://t.me/cvenotify/76226 · Telegram Post