WordPress Reset Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability exists in the WordPress Reset plugin, affecting all versions through 1.6. The issue arises from inadequate nonce validation in the reset_db_page() function, allowing unauthenticated attackers to reset various database tables, including comments, themes, and plugins. This exploitation requires tricking a site administrator into clicking a link that initiates the forged request.

Impact

Exploitation of this vulnerability allows for Cross-Site Request Forgery, enabling unauthorized actions to be performed on behalf of a user, potentially leading to significant changes in the site's database, such as deleting comments or altering plugin and theme settings.

Remediation

Users are advised to update the WordPress Reset plugin to version 1.7 or a newer patched version.