Medium severity · published Apr 9, 2024
CVE-2023-6799
WP Reset <= 2.0 - Sensitive Information Exposure due to Insufficient Randomness
5.9
CVSS
0.7%
EPSS
No
On KEV
Description
The WP Reset – Most Advanced WordPress Reset Tool plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0 via the use of insufficiently random snapshot names. This makes it possible for unauthenticated attackers to extract sensitive data including site backups by brute-forcing the snapshot filenames. Please note that the vendor does not plan to do any further hardening on this functionality.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WR
WP Reset · webfactory
through 2.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-6799
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-6799
Product
https://plugins.trac.wordpress.org/changeset?old_path=/wp-reset/tags/1.99&old=3059287&new_path=/wp-reset/tags/2.0&new=3059287&sfp_email=&sfph_mail=
Patch
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3071811%40wp-reset&new=3071811%40wp-reset&sfp_email=&sfph_mail=
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/68f41e88-ed36-4361-bddd-41495a540cd9?source=cve
More from WP Reset
5.3
CVE-2025-10645
WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
4.3
CVE-2024-4661
WP Reset <= 2.02 - Missing Authorization to License Key Modification