CVE-2020-7048: Missing Authentication for Critical Function

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state deleting all site content stored in that table, as demonstrated by a wp-admin/admin-post.php?db-reset-tables=comments...

PT-2020-19356

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any unauthenticated user to reset any table in the database to the initial WordPress set-up state, resulting in the deletion of all site content stored in that table. This...

CVE-2020-7047: Improper Privilege Management

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability with a simple wp-admin/admin.php?db-reset-tables=users request to escalate their privileges to administrator while dropping all other users from the table...

PT-2020-19355

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any authenticated user with minimal permissions to escalate their privileges to administrator by sending a request to the "wp-admin/admin.php?db-reset-tables=users" API...