CVE-2026-119615: Reset Database <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()

Q: Which sites are exposed to exploitation?

Sites using Reset Database version 1.1.3 or earlier are exposed if an attacker can authenticate with any account at subscriber level or higher. The described gate passes when there is no WordPress administrator account literally named "admin," which is the default on modern installations.

Q: What access does an attacker need?

The attacker needs valid WordPress credentials for a subscriber-level account or any higher-privileged account. No user interaction is required, and the vulnerable process does not require the attacker to know an existing administrator's password.

Q: What is the likely impact of successful exploitation?

An attacker can drop all database tables using the WordPress prefix, reinstall WordPress with attacker-controlled credentials, become the sole site administrator, and delete the uploads directory. This can result in complete site takeover and destructive loss of site data and uploaded files.

Q: Does having an administrator account named "admin" prevent exploitation?

The vulnerable condition is described as passing whenever no administrator is literally named "admin." An administrator account with that exact username may prevent that specific gate from passing, but the provided information does not establish it as a complete mitigation.

Published Nov 11, 2026

Updated

The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.3. This is due to the processreset() function being registered on admininit with no capability check, a computed-but-unused nonce, a gating condition that passes whenever no WordPress administrator literally named 'admin' exists (the default on modern installs), and an identity test that verifies the ATTACKER'S OWN password rather than an administrator's. This makes it possible for authenticated attackers, with subscriber-level access and above, to drop every prefixed database table, re-run wpinstall() with their own credentials — making the attacker the sole site administrator — authenticate as that administrator via wpsetauthcookie(), and delete the uploads directory.

Event History

Nov 11, 2026

CVE Published

via MITRE·11:31 AM

Data Sourced

via MITRE·11:31 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which sites are exposed to exploitation?

Sites using Reset Database version 1.1.3 or earlier are exposed if an attacker can authenticate with any account at subscriber level or higher. The described gate passes when there is no WordPress administrator account literally named "admin," which is the default on modern installations.

What access does an attacker need?

The attacker needs valid WordPress credentials for a subscriber-level account or any higher-privileged account. No user interaction is required, and the vulnerable process does not require the attacker to know an existing administrator's password.

What is the likely impact of successful exploitation?

An attacker can drop all database tables using the WordPress prefix, reinstall WordPress with attacker-controlled credentials, become the sole site administrator, and delete the uploads directory. This can result in complete site takeover and destructive loss of site data and uploaded files.

Does having an administrator account named "admin" prevent exploitation?

The vulnerable condition is described as passing whenever no administrator is literally named "admin." An administrator account with that exact username may prevent that specific gate from passing, but the provided information does not establish it as a complete mitigation.

CVE-2026-119615: Reset Database <= 1.1.3 - Authenticated (Subscriber+) Privilege Escalation to Missing Capability and Nonce Check in process_reset()

Event History

Frequently Asked Questions

Which sites are exposed to exploitation?

What access does an attacker need?

What is the likely impact of successful exploitation?

Does having an administrator account named "admin" prevent exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which sites are exposed to exploitation?

What access does an attacker need?

What is the likely impact of successful exploitation?

Does having an administrator account named "admin" prevent exploitation?