CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2DescriptionNVD
The WP Reset plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.05 via the WF_Licensing::log() method when debugging is enabled (default). This makes it possible for unauthenticated attackers to extract sensitive license key and site data.
AnalysisAI
WP Reset plugin for WordPress versions up to 2.05 expose sensitive license keys and site data through unauthenticated access to the WF_Licensing::log() method when debugging is enabled by default. Remote attackers can extract confidential information including license credentials without authentication, creating a direct pathway to account compromise and unauthorized access to site administration features. No public exploit code or active exploitation has been confirmed, but the low attack complexity and default dangerous configuration significantly elevate real-world risk.
Technical ContextAI
The WP Reset plugin uses a WF_Licensing class with a log() method that writes sensitive data (license keys, site identifiers) to debug logs accessible via HTTP requests. CWE-532 (Insertion of Sensitive Information into Log File) describes the root cause: the application logs authentication credentials and other sensitive identifiers in a format and location that can be retrieved by attackers. The vulnerability is enabled by WordPress's default WP_DEBUG setting when active, and the plugin fails to implement proper access controls (authentication checks) or output encoding on the debug log endpoint. The default-enabled debugging configuration means most affected installations are vulnerable without additional misconfiguration required.
Affected ProductsAI
WP Reset plugin for WordPress, all versions up to and including 2.05, affects any WordPress installation with the plugin active and debugging enabled (CWE-532 in CPE context would be wp:reset_plugin:*:*). The vulnerability is confirmed by Wordfence threat intelligence and documented in the WordPress plugins repository changeset 3364169. WordPress 5.0 and later are the typical deployment target, though the plugin itself operates independently of WordPress core version.
RemediationAI
Upgrade WP Reset plugin to version 2.06 or later, which addresses the WF_Licensing::log() information exposure by implementing proper authentication checks and disabling sensitive data logging in debug output. Immediate workaround: disable WordPress debug logging (set WP_DEBUG to false in wp-config.php) and restrict access to debug.log files via .htaccess or web server configuration if WP_DEBUG cannot be disabled. Verify no cached or historical debug logs containing license keys remain accessible. See WordPress plugins repository changeset 3364169 and Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/86741f4a-8700-45dd-8998-b3f0387c27ed for additional mitigation steps.
Share
External POC / Exploit Code
Leaving vuln.today