WordPress CVEs

Description

The WP Reset plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_ajax function in all versions up to, and including, 2.02. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the value fo the 'License Key' field for the 'Activate Pro License' setting.

Affected WordPress components

• WP Reset Plugin · wp-reset
  Confirmed match Active
  Up to and including 2.02; Up to and including 2.01
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• webfactory WP Reset — Up to and including 2.01
• webfactoryltd wp_reset — Up to and including 2.02
• webfactoryltd wp_reset — Before 2.03

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset/3097597/wp-reset Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/0d2dc86e-f937-429f-9baa-0eb0a8715513?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record