CVE-2020-7048: webfactoryltd wp_database_reset
Vulnerability summary
CVE-2020-7048 is a critical (CVSS 9.1) vulnerability in webfactoryltd wp_database_reset. EPSS estimates a 22.93% chance of exploitation in the next 30 days, higher than 97.7% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 16-01-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that allowed any unauthenticated user to reset any table in the database to the initial WordPress set-up state (deleting all site content stored in that table), as demonstrated by a wp-admin/admin-post.php?db-reset-tables[]=comments URI.
CVSS metrics
5 scores · 3 sources · 3 versions- wordfenceSource9.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
- NVDNIST9.1CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
EPSS trend
Probability
22.93%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 22.93% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wordfence.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Webfactoryltd1 product
- wp_database_reset≤ 3.1
Wordpress1 product
- wordpress-database-reset≤ 3.1 (fixed in 3.15)
2 vendors · 2 products