36 matches found
CVE-2021-36909
Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin versions = 5.98 allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover...
WordPress plugin WP Reset PRO Premium 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2020-36334
themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...
CVE-2020-36333
themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...
CVE-2020-36334
themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...
Authentication flaw
themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...
Cross site request forgery (csrf)
themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...
CVE-2020-36334
The CVE affects the WordPress plugin themegrill-demo-importer, with versions before 1.6.3. The vulnerability is cross-site request forgery (CSRF) in the plugin, demonstrated by the ability to wipe the database. Root cause details are not explicitly provided beyond the CSRF issue. Impact, as state...
PT-2021-12011 · Unknown · Themegrill-Demo-Importer
Name of the Vulnerable Software and Affected Versions: themegrill-demo-importer versions prior to 1.6.2 Description: The issue allows unauthorized access to wipe the database due to a lack of authentication requirement in the reset wizard actions hook. Recommendations: For themegrill-demo-importe...
WordPress ThemeGrill Demo Importer plugin <= 1.6.2 - Bypass and Database Wipe vulnerability
Bypass and Database Wipe vulnerability discovered by Dave Patchstack in WordPress ThemeGrill Demo Importer plugin versions = 1.6.2. Solution Update the WordPress ThemeGrill Demo Importer plugin to the latest available version at least 1.6.3...
WordPress Plugin 'ThemeGrill Demo Importer' 1.3.4 < 1.6.3 Database Wipe and Auth Bypass
The WordPress application running on the remote host has the 'ThemeGrill Demo Importer' plugin that is 1.3.4 or later, but prior to 1.6.3. It is, therefore, vulnerable to an missing authentication check that allows an unauthenticated user to wipe the entire database to its default state and then...
ThemeGrill Demo Importer Plugin for WordPress < 1.6.2 Database Wipe and Authentication Bypass
The WordPress ThemeGrill Demo Importer Plugin installed on the remote host is affected by a database wipe and authentication bypass vulnerability due to improper access controls. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported...
WordPress ThemeGrill Demo Importer Plugin 1.3.4 < 1.6.3 Authentication Bypass and Database Wipe Vulnerability
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe
There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...
ThemeGrill Demo Importer < 1.6.3 - Auth Bypass & Database Wipe
There is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state after which they are automatically logged in as an administrator. Edit WPScanTeam: v1.6.2 was released with an insufficient fix, allowing attackers to still exploit the issue using a CSR...
