---
id: "CVE-2026-119615"
page: "https://infrastack.ai/live/CVE-2026-119615"
kind: "vulnerability"
aliases: ["CVE-2026-119615"]
title: "WordPress Reset Database plugin: subscriber can wipe site and seize admin"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "wordpress", "wp-plugin"]
not_affected_if: ["no-subscriber-accounts", "plugin-not-installed"]
published_at: "2026-11-11T12:19:15+00:00"
first_seen_at: "2026-11-11T12:27:10+00:00"
updated_at: "2026-11-11T12:28:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119615", "first_seen_at": "2026-11-11T12:27:10+00:00"}]
exploit_sources: []
---

# WordPress Reset Database plugin: subscriber can wipe site and seize admin

Link for people: https://infrastack.ai/live/CVE-2026-119615 (this .md is for agents)

The Reset Database plugin for WordPress up to and including 1.1.3 runs its reset routine on admin_init without a capability check. An authenticated subscriber can drop the site's database tables, reinstall WordPress with their own account as sole administrator, and delete uploads.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Look for the Reset Database plugin in the plugins list of the WordPress admin or in `wp-content/plugins/`
- Check the installed plugin version; versions `1.1.3` and below are affected

## Fix

- Reset Database plugin: unknown (sources do not state a fixed version)

## Timeline

- 2026-11-11T12:27:10+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119615

## From the sources

The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the process_reset() function being registered on admin_init with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named 'admin' exists (the default on modern installs), and an identity test that verifies the ATTACKER'S OWN password rather than an administrator's. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wp_install() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wp_set_auth_cookie(), and delete the uploads directory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_