Privilege Escalation Vulnerability in Reset Database Plugin for WordPress

CVE-2026-119615

What is CVE-2026-119615?

The Reset Database plugin for WordPress is affected by a vulnerability that allows authenticated users with subscriber-level access and higher to escalate privileges. The flaw originates from the process_reset() function, which lacks necessary capability checks. Additionally, the absence of a valid nonce and conditions that bypass checks when no administrator named 'admin' exists creates an exploitable situation. This vulnerability enables attackers to drop database tables, re-run wp_install() with unauthorized credentials, subsequently becoming the sole administrator of the site, and also allows them to authenticate as that administrator and delete critical directories.

References