https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 12 Nov 2026 11:44:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-119615 <p>The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named &#39;admin&#39; exists (the default on modern installs), and an identity test that verifies the ATTACKER&#39;S OWN password rather than an administrator&#39;s. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.</p> <p>The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named &#39;admin&#39; exists (the default on modern installs), and an identity test that verifies the ATTACKER&#39;S OWN password rather than an administrator&#39;s. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.</p> https://db.gcve.eu/vuln/fkie_cve-2026-119615 https://db.gcve.eu/vuln/ghsa-qrxx-fg3m-g5wv <p>The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named &#39;admin&#39; exists (the default on modern installs), and an identity test that verifies the ATTACKER&#39;S OWN password rather than an administrator&#39;s. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.</p> <p>The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named &#39;admin&#39; exists (the default on modern installs), and an identity test that verifies the ATTACKER&#39;S OWN password rather than an administrator&#39;s. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.</p> https://db.gcve.eu/vuln/ghsa-qrxx-fg3m-g5wv