CVE-2026-119615

Name of the Vulnerable Software and Affected Versions Reset Database plugin for WordPress versions prior to 1.1.4

Description An issue allows authenticated users with subscriber-level access and above to escalate privileges. This occurs because the process reset() function is registered on admin init without a capability check and uses a computed-but-unused nonce. Additionally, a gating condition is bypassed if no administrator named 'admin' exists, and the identity test verifies the attacker's own password instead of an administrator's. An attacker can exploit this to drop all prefixed database tables, execute wp install() with their own credentials to become the sole site administrator, authenticate via wp set auth cookie(), and delete the uploads directory.

Recommendations Update the plugin to a version newer than 1.1.3. As a temporary workaround, restrict access to the process reset() function.