Unauthorized Database Reset Vulnerability in Blaze Demo Importer Plugin for WordPress

CVE-2025-13334

What is CVE-2025-13334?

The Blaze Demo Importer plugin for WordPress has a critical vulnerability due to its lack of capability checks in the 'blaze_demo_importer_install_demo' function. This deficiency allows authenticated users, even those with basic subscriber privileges, to perform unauthorized database resets. The potential impact includes truncating database tables indiscriminately (excluding critical tables such as options, usermeta, and users), which can lead to significant data loss. Additionally, attackers could delete sidebar widgets, modify theme settings, and erase content from the uploads directory, severely compromising the integrity and functionality of WordPress sites utilizing this plugin.

References