An issue allows authenticated users with subscriber-level access and above to escalate privileges. This occurs because the `process reset()` function is registered on `admin init` without a capability check and uses a computed-but-unused nonce. Additionally, a gating condition is bypassed if no administrator named 'admin' exists, and the identity test verifies the attacker's own password instead of an administrator's. An attacker can exploit this to drop all prefixed database tables, execute `wp install()` with their own credentials to become the sole site administrator, authenticate via `wp set auth cookie()`, and delete the uploads directory.