CVE-2024-13684
Published: 18 February 2025
Description
The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthenticated attackers to reset several tables in the database like comments, themes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Security Summary
CVE-2024-13684 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the Reset plugin for WordPress in all versions up to and including 1.6. The issue stems from missing or incorrect nonce validation in the reset_db_page() function, which fails to properly verify requests. This flaw has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating high severity due to its potential for significant integrity and availability impacts without requiring authentication or privileges.
Unauthenticated attackers can exploit this vulnerability by crafting a forged request that tricks a site administrator into performing an action, such as clicking a malicious link. Successful exploitation allows the attacker to reset multiple database tables, including those for comments, themes, plugins, and others, potentially disrupting site functionality and data integrity.
Advisories from Wordfence and the WordPress plugin trac repository detail mitigation steps, with a specific changeset (3243886) in the Reset plugin repository indicating the patch that addresses the nonce validation issue. Security practitioners should update to a version beyond 1.6 and review access to the plugin's reset functionality.
Details
- CWE(s)