CVE-2020-7047: webfactoryltd wp_database_reset Improper Privilege Management
Vulnerability summary
CVE-2020-7047 is a critical (CVSS 9.9) Improper Privilege Management vulnerability in webfactoryltd wp_database_reset. EPSS estimates a 2.46% chance of exploitation in the next 30 days, higher than 84.2% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability (with a simple wp-admin/admin.php?db-reset-tables[]=users request) to escalate their privileges to administrator while dropping all other users from the table.
CVSS metrics
5 scores · 3 sources · 3 versions- wordfenceSource9.9CriticalCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HDiffers
- NVDNIST9.9CriticalCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS trend
Probability
2.46%
Chance of exploitation in the next 30 days
Percentile
84%
Versus all other CVEs
30-day change
0.00 pp
From 2.46% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Webfactoryltd1 product
- wp_database_reset≤ 3.1
Wordpress1 product
- wordpress-database-reset≤ 3.1 (fixed in 3.15)
2 vendors · 2 products