{"id":"CVE-2026-119615","kind":"vulnerability","aliases":["CVE-2026-119615"],"related":[],"title":"WordPress Reset Database plugin: subscriber can wipe site and seize admin","description":"The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named 'admin' exists (the default on modern installs), and an identity test that verifies the ATTACKER'S OWN password rather than an administrator's. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.","summary":"The Reset Database plugin for WordPress up to and including 1.1.3 runs its reset routine on admin_init without a capability check. An authenticated subscriber can drop the site's database tables, reinstall WordPress with their own account as sole administrator, and delete uploads.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-plugin"],"not_affected_if":["no-subscriber-accounts","plugin-not-installed"],"how_to_check":"- Look for the Reset Database plugin in the plugins list of the WordPress admin or in `wp-content/plugins/`\n- Check the installed plugin version; versions `1.1.3` and below are affected","fix":"- Reset Database plugin: unknown (sources do not state a fixed version)","status":"open","published_at":"2026-11-11T12:19:15+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","triaged_at":"2026-11-11T12:28:27+00:00","updated_at":"2026-11-11T12:28:27+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-11T12:28:27Z","model":"claude-haiku-5-5","output":{"fix":"- Reset Database plugin: unknown (sources do not state a fixed version)","reach":"internet","title":"WordPress Reset Database plugin: subscriber can wipe site and seize admin","impact":"high","summary":"The Reset Database plugin for WordPress up to and including 1.1.3 runs its reset routine on admin_init without a capability check. An authenticated subscriber can drop the site's database tables, reinstall WordPress with their own account as sole administrator, and delete uploads.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-plugin","self-hosted"],"confidence":0.8,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker drops all database tables and takes over the site","analyst_note":"Confirm the fixed plugin version and whether the plugin is still maintained, via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-119615 and the WordPress plugin repository page.","how_to_check":"- Look for the Reset Database plugin in the plugins list of the WordPress admin or in `wp-content/plugins/`\n- Check the installed plugin version; versions `1.1.3` and below are affected\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-subscriber-accounts"],"who_is_affected":"Sites running the Reset Database plugin version 1.1.3 or earlier. The flaw is reachable by any logged-in user with subscriber-level access or higher, and the plugin's gating condition passes on default installs where no administrator is named 'admin'. Sites without the plugin installed are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000779,"input_tokens":4704,"output_tokens":618,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-119615':14A,17A '-2026':13A,16A '1.1.3':36B,87C 'access':156C 'account':63B 'admin':11A,42B,99C,122C 'administr':66B,119C,143C,180C,184C 'attack':136C,151C,176C 'auth':188C 'authent':49B,150C,181C 'capabl':46B,103C 'check':47B,104C 'comput':107C 'computed-but-unus':106C 'condit':113C 'cooki':189C 'credenti':173C 'cve':12A,15A 'databas':3A,28B,56B,72C,163C 'default':125C 'delet':68B,191C 'directori':194C 'drop':52B,160C 'due':90C 'escal':80C 'everi':161C 'exist':123C 'function':95C 'gate':112C 'host':21B 'ident':131C 'includ':35B,86C 'init':43B,100C 'instal':128C,169C 'level':155C 'liter':120C 'make':146C,174C 'modern':127C 'name':121C 'nonc':110C 'packag':18B 'pass':115C 'password':139C 'plugin':4A,25B,29B,73C 'possibl':148C 'prefix':162C 'privileg':79C 'process':93C 'rather':140C 're':166C 're-run':165C 'regist':97C 'reinstal':58B 'reset':2A,27B,39B,71C,94C 'routin':40B 'run':37B,167C 'seiz':10A 'self':20B 'self-host':19B 'set':187C 'site':8A,54B,179C 'sole':65B,178C 'subscrib':5A,50B,154C 'subscriber-level':153C 'tabl':57B,164C 'test':132C 'unus':109C 'upload':69B,193C 'verifi':134C 'version':82C 'via':185C 'vulner':77C 'whenev':116C 'wipe':7A 'without':44B 'wordpress':1A,22B,31B,59B,75C,118C 'wp':24B,168C,186C 'wp-plugin':23B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Reset Database plugin version 1.1.3 or earlier. The flaw is reachable by any logged-in user with subscriber-level access or higher, and the plugin's gating condition passes on default installs where no administrator is named 'admin'. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","selfhosted","wordpress","wpplugin"],"campaign_type":null,"search_a":"'-119615':14A,17A '-2026':13A,16A 'admin':11A 'cve':12A,15A 'databas':3A 'plugin':4A 'reset':2A 'seiz':10A 'site':8A 'subscrib':5A 'wipe':7A 'wordpress':1A","search_b":"'1.1.3':36B 'account':63B 'admin':42B 'administr':66B 'authent':49B 'capabl':46B 'check':47B 'databas':28B,56B 'delet':68B 'drop':52B 'host':21B 'includ':35B 'init':43B 'packag':18B 'plugin':25B,29B 'reinstal':58B 'reset':27B,39B 'routin':40B 'run':37B 'self':20B 'self-host':19B 'site':54B 'sole':65B 'subscrib':50B 'tabl':57B 'upload':69B 'without':44B 'wordpress':22B,31B,59B 'wp':24B 'wp-plugin':23B","search_c":"'1.1.3':87C 'access':156C 'admin':99C,122C 'administr':119C,143C,180C,184C 'attack':136C,151C,176C 'auth':188C 'authent':150C,181C 'capabl':103C 'check':104C 'comput':107C 'computed-but-unus':106C 'condit':113C 'cooki':189C 'credenti':173C 'databas':72C,163C 'default':125C 'delet':191C 'directori':194C 'drop':160C 'due':90C 'escal':80C 'everi':161C 'exist':123C 'function':95C 'gate':112C 'ident':131C 'includ':86C 'init':100C 'instal':128C,169C 'level':155C 'liter':120C 'make':146C,174C 'modern':127C 'name':121C 'nonc':110C 'pass':115C 'password':139C 'plugin':73C 'possibl':148C 'prefix':162C 'privileg':79C 'process':93C 'rather':140C 're':166C 're-run':165C 'regist':97C 'reset':71C,94C 'run':167C 'set':187C 'site':179C 'sole':178C 'subscrib':154C 'subscriber-level':153C 'tabl':164C 'test':132C 'unus':109C 'upload':193C 'verifi':134C 'version':82C 'via':185C 'vulner':77C 'whenev':116C 'wordpress':75C,118C 'wp':168C,186C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119615","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119615","severity":null,"published_at":"2026-11-11T12:19:15+00:00","modified_at":"2026-11-11T12:19:15+00:00","first_seen_at":"2026-11-11T12:27:10+00:00","fetched_at":"2026-11-11T12:27:10+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}