Paper/Archive/CVE-2020-7047

CVE-2020-7047

mitre — The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the abil…

EPSS 2%CVSS 9.9

critical.is priorityof 100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 Not in CISA KEV+300.0 EPSS percentile 84.5.845 × 2016.9 No public exploit+100.0 SSVC exploitation: unknown+100.0

Description · from the CVE record

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.

Affected

ProductAffectedFixed inSource

n/an/a–CNA

Scores by source

mitre (CNA)9.9CVSS:3.0/AC:L/AV:N/A:H/C:H/I:H/PR:L/S:C/UI:N

References

refwordpress.org/plugins/wordpress-database-reset/#developers refwpvulndb.com/vulnerabilities/10028 refwordfence.com/blog/2020/01/easily-exploitable-vulnerabilities-patched-in-wp-database-reset-plugin