CVE-2024-13684
📋 TL;DR
The Reset plugin for WordPress has a CSRF vulnerability that allows unauthenticated attackers to trick administrators into clicking malicious links that reset database tables. This affects all WordPress sites using Reset plugin versions 1.6 and earlier. Attackers can delete comments, themes, plugins, and other critical data without authentication.
💻 Affected Systems
- WordPress Reset Plugin
📦 What is this software?
Reset by Smartzminds
⚠️ Risk & Real-World Impact
Worst Case
Complete data loss including comments, themes, plugins, and other WordPress database tables, potentially causing site downtime and requiring full restoration from backups.
Likely Case
Partial data loss where attackers reset specific tables like comments or plugins, disrupting site functionality and user experience.
If Mitigated
No impact if proper CSRF protections are in place or if administrators don't click malicious links.
🎯 Exploit Status
Exploitation requires social engineering to trick administrators into clicking malicious links. No authentication required for the reset action itself.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.6
Vendor Advisory: https://plugins.trac.wordpress.org/browser/reset
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find 'Reset' plugin
4. Click 'Update Now' if available
5. If no update available, deactivate and delete the plugin
6. Check for updated version in WordPress plugin repository
🔧 Temporary Workarounds
Disable Reset Plugin
allTemporarily disable the vulnerable plugin until patched version is available
wp plugin deactivate reset
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent CSRF attacks
- Use WordPress security plugins that add CSRF protection layer
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → Installed Plugins for 'Reset' plugin version 1.6 or earlierCheck Version:
wp plugin list --name=reset --field=versionVerify Fix Applied:
Verify plugin version is higher than 1.6 or plugin is completely removed📡 Detection & Monitoring
Log Indicators:
- Unusual database table truncation/reset operations
- Multiple DELETE operations on wp_comments, wp_options tables
Network Indicators:
- POST requests to /wp-admin/admin-post.php with reset_db_page action without proper nonce
SIEM Query:
source="wordpress.log" AND ("reset_db_page" OR "truncate table" OR "DELETE FROM wp_")