ThemeGrill Demo Importer < 1.6.2 - Database Reset

ThemeGrill Demo Importer before 1.6.2 does not require authentication for wiping the database due to a resetwizardactions hook. In versions 1.3.4 and above and versions 1.6.1 and below, there is a vulnerability that allows any unauthenticated user to wipe the entire database to its default state...

CVE-2020-36333

creationtimestamp| type| source ---|---|--- 2025-06-21 05:08:44+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2020/CVE-2020-36333.yaml 2025-06-24 21:02:25+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lseymlaka722...

CVE-2020-36333

themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...

CVE-2020-36333

ThemeGrill Demo Importer prior to 1.6.2 is vulnerable via a reset_wizard_actions hook that allows unauthenticated users to wipe the entire WordPress database. The issue affects versions from 1.3.4 upward and 1.6.1 and below, enabling a full database reset to default state and automatic administra...