This WordPress vulnerability could let hackers hijack your entire site

(Image credit: Pixabay)

A WordPress plugin has been discovered to contain “easily exploitable” security issues that could be leveraged by an attacker to gain complete control over vulnerable websites.

The plugin is called WP Database Reset and it is used to reset databases without having to go through the standard WordPress installation process. The security issue has the potential to affect many websites as the WordPress library says it is active on over 80,000 sites.

Two severe vulnerabilities were found by the Wordfense security team and either of these vulnerabilities can be used to force a full website reset or takeover according to the firm.

Wordfense's Chloe Chamberland explained just how damaging these vulnerabilities could be to websites in a blog post detailing the firm's findings, saying:

“A WordPress database stores all data that makes up the site including posts, pages, users, site options, comments, and more. With a few simple clicks and a couple of seconds, an unauthenticated user could wipe an entire WordPress installation clean if that installation was using a vulnerable version of this plugin.”

Critical security flaws

The first critical security flaw is tracked as CVE-2020-7048 and since none of the database reset functions were secured through any checks, it could allow any user to reset any database tables without authentication.

The other vulnerability discovered by Wordfense is tracked as CVE-2020-7047 and it allowed any authenticated users to grant themselves administrative privileges while also giving them the ability to “drop all other users from the table with a simple request”.

Wordfense first made WP Database Reset's developer aware of the security issues on January 8 after verifying their findings. The developer responded on January 13 and promised a patch would be released the next day and the vulnerabilities were publicly disclosed a few days later.

Users of the WP Database Reset plugin should updated to the latest version (version 3.15) as soon as possible to prevent having their website hijacked by hackers or wiped out completely.

Via ZDNet

Anthony Spadafora

After working with the TechRadar Pro team for the last several years, Anthony is now the security and networking editor at Tom’s Guide where he covers everything from data breaches and ransomware gangs to the best way to cover your whole home or business with Wi-Fi. When not writing, you can find him tinkering with PCs and game consoles, managing cables and upgrading his smart home.