Wordfence announced that they discovered an easily exploitable vulnerability in a WordPress plugin.
Wordfence has announced that their Threat Intelligence team has discovered important vulnerabilities in a WordPress plugin which is installed on over 80,000 websites. One of these flaws allows any unauthenticated user to reset any table from the database. Another flaw allows any authenticated user, even with the minimal permissions to grant their account administrative privileges and dropping all other users from the table with a request.
- Also you may be interested in: What is WordPress?
WP Database Reset
These flaws can cause complete site resets and takeovers. To avoid the risk, Wordfence urges WP Database Reset users to update the plugin to the latest version, 3.15 immediately. Wordfence has also announced that Wordfence users were already protected since the discovery was made with a custom firewall rule.
WP Database Reset is a database reset plugin that provides users with the ability to reset any database tables on their site to the same state as a fresh WordPress install. This plugin is handy for administrators doing testing on their website and for administrators who want to start over without requiring a complete WordPress re-installation. But none of the database reset functions in the plugin were securely protected with capability checks or security nonces. Without proper security controls in place, the WP Database Reset plugin contained a serious flaw that allowed any unauthenticated user the ability to reset any table in the database.
Source: 1
See more Cyber Security News