This WordPress vulnerability could let hackers hijack your entire site
Users of the WP Database Reset plugin should upgrade to the latest version immediately
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
AWordPress pluginhas been discovered to contain “easily exploitable” security issues that could be leveraged by an attacker to gain complete control over vulnerable websites.
The plugin is called WP Database Reset and it is used to reset databases without having to go through the standard WordPress installation process. The security issue has the potential to affect many websites as the WordPress library says it is active on over 80,000 sites.
Two severe vulnerabilities were found by the Wordfense security team and either of these vulnerabilities can be used to force a full website reset or takeover according to the firm.
Wordfense’s Chloe Chamberland explained just how damaging these vulnerabilities could be to websites in ablog postdetailing the firm’s findings, saying:
“A WordPress database stores all data that makes up the site including posts, pages, users, site options, comments, and more. With a few simple clicks and a couple of seconds, an unauthenticated user could wipe an entire WordPress installation clean if that installation was using a vulnerable version of this plugin.”
Critical security flaws
The first critical security flaw is tracked as CVE-2020-7048 and since none of the database reset functions were secured through any checks, it could allow any user to reset any database tables without authentication.
The other vulnerability discovered by Wordfense is tracked as CVE-2020-7047 and it allowed any authenticated users to grant themselvesadministrative privilegeswhile also giving them the ability to “drop all other users from the table with a simple request”.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Wordfense first made WP Database Reset’s developer aware of the security issues on January 8 after verifying their findings. The developer responded on January 13 and promised a patch would be released the next day and the vulnerabilities were publicly disclosed a few days later.
Users of the WP Database Reset plugin should updated to the latest version (version 3.15) as soon as possible to prevent having their website hijacked by hackers or wiped out completely.
ViaZDNet
After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.
This new phishing strategy utilizes GitHub comments to distribute malware
Should your VPN always be on?
NYT Strands today — hints, answers and spangram for Sunday, November 10 (game #252)
