CVE-2021-36908
📋 TL;DR
This CSRF vulnerability in WP Reset PRO plugin allows attackers to trick authenticated administrators into performing unintended actions, specifically resetting the WordPress database to default settings. It affects WordPress sites using WP Reset PRO plugin version 5.98 and earlier. The vulnerability requires an administrator to be logged in and visit a malicious page.
💻 Affected Systems
- WebFactory Ltd. WP Reset PRO WordPress Plugin
📦 What is this software?
Wp Reset Pro by Webfactoryltd
⚠️ Risk & Real-World Impact
Worst Case
Complete database reset leading to loss of all posts, pages, settings, and customizations, effectively destroying the WordPress site.
Likely Case
Partial or complete database reset causing significant data loss and site downtime requiring restoration from backups.
If Mitigated
No impact if proper CSRF protections are in place or if administrators don't visit malicious sites while logged in.
🎯 Exploit Status
CSRF attacks are well-understood and easy to implement. Exploit requires social engineering to get administrator to visit malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.99
Vendor Advisory: https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WP Reset PRO and update to version 5.99 or later. 4. Verify update completed successfully.
🔧 Temporary Workarounds
Disable WP Reset PRO Plugin
allTemporarily disable the vulnerable plugin until patched
wp plugin deactivate wp-reset-pro
Implement CSRF Protection Headers
linuxAdd security headers to WordPress to help prevent CSRF attacks
Add to .htaccess: Header set X-Frame-Options "SAMEORIGIN"
Add to .htaccess: Header set Content-Security-Policy "frame-ancestors 'self'"
🧯 If You Can't Patch
- Restrict administrator access to trusted networks only
- Implement strict browser security policies and educate administrators about CSRF risks
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WP Reset PRO version <= 5.98Check Version:
wp plugin list --name=wp-reset-pro --field=versionVerify Fix Applied:
Verify WP Reset PRO plugin version is 5.99 or higher in WordPress admin panel📡 Detection & Monitoring
Log Indicators:
- Unexpected database reset operations
- Multiple failed login attempts followed by plugin activation
Network Indicators:
- POST requests to wp-admin/admin-post.php with reset parameters from unexpected sources
SIEM Query:
source="wordpress.log" AND "wp_reset" AND "database" AND "reset"🔗 References
- https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-cross-site-request-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve
- https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
- https://patchstack.com/database/vulnerability/wp-reset/wordpress-wp-reset-pro-premium-plugin-5-98-cross-site-request-forgery-csrf-vulnerability-leading-to-database-reset?_s_id=cve
- https://patchstack.com/wp-reset-pro-critical-vulnerability-fixed/
