Application Security

Critical Flaw in WordPress Plugin Leads to Database Wipe

A major security vulnerability in the WP Reset PRO WordPress plugin could be exploited by an authenticated user to wipe the entire database of a website, according to a warning from researchers at Packstack (formerly WebARX).

Ionut Arghire

November 10, 2021

The issue can be exploited by any authenticated user, regardless of their authorization, to wipe all tables in a WordPress installation’s database.

This would trigger the restart of the WordPress installation process. An attacker could abuse this to create an administrator account onto the WordPress website (an admin account must be created to complete the installation process), according to a Patchstack advisory.

An attacker could further exploit the newly created account to upload malicious plugins to the website, or even install trojan backdoors.

[ READ: WordPress 5.8.1 Patches Several Vulnerabilities ]

WP Reset PRO aims to help site administrators to easily reset a website’s database to the default installation while leaving files intact, to restore damaged sites, and remove customizations or parts of the site.

WP Reset PRO registers a few actions in the admin_action_* scope, including table deletion operation, but no check is performed to learn whether the user is indeed authorized to perform such an action, and because a nonce token to prevent CSRF attacks isn’t validated or checked.

Because of this vulnerability, “someone could simply visit the homepage of the site to start the WordPress installation process,” Patchstack warned.

WebFactory Ltd, which develops both the WP Reset and its PRO version, addressed the issue in version 5.99 of the plugin, by adding an authentication and authorization check, along with a check for a valid nonce token.

“It’s quite a destructive vulnerability, quite a problem for e-commerce and other sites that have open registration,” Patchstack CEO Oliver Sild told SecurityWeek.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar

Secrets to a Good Security Webinar or Conference Presentation

Tips for making a presentation that will help improve the state of security programs and reflect favorably on the presenters and their companies

Joshua Goldfarb

Application Security

Source Code Security Firm Cycode Launches With $4.6 Million in Funding

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Eduard KovacsSeptember 24, 2019

Network Security

NSA Publishes Security Guidance for Organizations Transitioning to IPv6

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Ionut Arghire5 days ago

Nation-State

North Korean APT Expands Its Attack Repertoire

The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...

Kevin Townsend3 days ago