8.8

CVE-2021-36909

Exploit

WordPress WP Reset PRO Premium plugin <= 5.98 - Authenticated Database Reset vulnerability

WP Reset – Most Advanced WordPress Reset Tool (PRO) 5.00- 5.98 - Missing Authorization to Database Reset

Authenticated Database Reset vulnerability in WordPress WP Reset PRO Premium plugin (versions <= 5.98) allows any authenticated user to wipe the entire database regardless of their authorization. It leads to a complete website reset and takeover.
Mögliche Gegenmaßnahme
WP Reset Pro – Most Advanced WordPress Reset Tool: Update to version 5.99, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Webfactoryltd ≫ Wp Reset Pro SwPlatformwordpress Version <= 5.98
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt WP Reset Pro – Most Advanced WordPress Reset Tool
Version 5.00-5.98
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.83% 0.76
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 8.1 2.8 5.2
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
nvd@nist.gov 5.5 8 4.9
AV:N/AC:L/Au:S/C:N/I:P/A:P
audit@patchstack.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
Third Party Advisory
Exploit
https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-authenticated-database-reset-vulnerability
Third Party Advisory
https://wpreset.com/changelog/
Vendor Advisory
Release Notes
https://www.wordfence.com/threat-intel/vulnerabilities/id/3e91fabe-469f-4743-bb8d-76ef20313b37
Third Party Advisory