CVE-2024-13684
Published: 18 February 2025
Summary
CVE-2024-13684 is a high-severity CSRF (CWE-352) vulnerability in Smartzminds Reset. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 16.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-23 (Session Authenticity) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-13684 is a Cross-Site Request Forgery (CSRF) vulnerability, classified under CWE-352, affecting the Reset plugin for WordPress in all versions up to and including 1.6. The issue stems from missing or incorrect nonce validation in the reset_db_page() function, which fails to properly verify requests. This flaw has a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H), indicating high severity due to its potential for significant integrity and availability impacts without requiring authentication or privileges.
Unauthenticated attackers can exploit this vulnerability by crafting a forged request that tricks a site administrator into performing an action, such as clicking a malicious link. Successful exploitation allows the attacker to reset multiple database tables, including those for comments, themes, plugins, and others, potentially disrupting site functionality and data integrity.
Advisories from Wordfence and the WordPress plugin trac repository detail mitigation steps, with a specific changeset (3243886) in the Reset plugin repository indicating the patch that addresses the nonce validation issue. Security practitioners should update to a version beyond 1.6 and review access to the plugin's reset functionality.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4832
Vulnerability details
The Reset plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6. This is due to missing or incorrect nonce validation on the reset_db_page() function. This makes it possible for unauthenticated attackers to…
more
reset several tables in the database like comments, themes, plugins, and more via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CSRF flaw in public-facing WordPress plugin directly enables T1190 exploitation leading to DB table resets that map to T1485 data destruction.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
SC-23 requires mechanisms like anti-CSRF tokens or nonces to authenticate session requests, directly preventing forged requests that exploit missing nonce validation in the reset_db_page() function.
SI-10 mandates validation of information inputs such as nonces, comprehensively addressing the lack of nonce verification that enables unauthenticated attackers to reset database tables via tricked administrator actions.
SI-2 ensures timely identification, reporting, and correction of flaws like the missing nonce validation in the Reset plugin, preventing exploitation through patching as evidenced by the specific changeset fix.