Quick answers
- Is CVE-2026-119615 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-119615 being exploited in the wild.
- How severe is CVE-2026-119615?
- High severity, with a CVSS score of 8.8, published 11 November 2026.
- Which products and versions are affected?
- WordPress.org Reset Database up to 1.1.3.
- Is there a fix for CVE-2026-119615?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-119615 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-119615?
- Check whether you run WordPress.org Reset Database at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The process_reset() function is registered on the admin_init hook without capability checks, relies on a computed but unused nonce, has a gating condition that defaults to true when no admin user named 'admin' exists (typical in modern WordPress), and validates the attacker's own password instead of an administrator's. Authenticated users with subscriber-level access or higher can exploit this via a network request to re-initialize WordPress under their control.
Affected products
- WordPress.org Reset Database up to 1.1.3
Timeline
- 2026-11-11: disclosed