Reset Database: Privilege escalation via process_reset() (CVE-2026-119615)
The Reset Database plugin for WordPress up to and including version 1.1.3 is vulnerable to privilege escalation due to a lack of capability checks in the process_reset() function.
CVE search metadata
CVE search record: CVE-2026-119615. Severity: high. CVSS: 8.8. KEV: no. Product: Reset Database (up to and including 1.1.3). Brief: Reset Database: Privilege escalation via process_reset() (CVE-2026-119615). Brief link: https://feed.craftedsignal.io/briefs/2026-11-reset-database-privilege-escalation-cve-2026-119615/
Triage facts
Revision 1- Applicability
- Reset Database (up to and including 1.1.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 13:55 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
CVE-2026-119615 affects the Reset Database plugin for WordPress in versions up to and including 1.1.3. The vulnerability exists because the process_reset() function is registered on admin_init without capability checks. Authenticated attackers with subscriber-level access and above can drop database tables, re-run wp_install() with their own credentials to become the site administrator, authenticate as that administrator, and delete the uploads directory.