CVE-2020-7047 - The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table

Back Back to CVE browser

HIGH

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table

Published Jan 16, 2020

8.8

HIGH

CVSS 3.1

EPSS 2.46%

Description

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-269

Improper Privilege Management

References (4)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28181
Advisory
https://wordpress.org/plugins/wordpress-database-reset/#developers
x_refsource_MISCRelease NotesThird Party Advisory
https://wpvulndb.com/vulnerabilities/10028
x_refsource_MISCThird Party Advisory
https://www.wordfence.com/blog/2020/01/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin/
x_refsource_MISCExploitPatchThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-28181		Advisory
https://wordpress.org/plugins/wordpress-database-reset/#developers		x_refsource_MISCRelease NotesThird Party Advisory
https://wpvulndb.com/vulnerabilities/10028		x_refsource_MISCThird Party Advisory
https://www.wordfence.com/blog/2020/01/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin/		x_refsource_MISCExploitPatchThird Party Advisory