CVE-2024-13684: Smartzminds Reset CSRF Vulnerability

CVE-2024-13684 Overview

CVE-2024-13684 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Reset plugin for WordPress, developed by Smartzminds. The flaw affects all versions up to and including 1.6. The root cause is missing or incorrect nonce validation in the reset_db_page() function. Unauthenticated attackers can leverage this weakness to reset critical database tables, including comments, themes, and plugins. Exploitation requires tricking a site administrator into clicking a crafted link or visiting an attacker-controlled page.

Critical Impact
Successful exploitation allows attackers to wipe WordPress database tables, destroying site content, themes, and plugin configurations without authentication.

Affected Products

Smartzminds Reset plugin for WordPress, versions up to and including 1.6
WordPress sites with the Reset plugin installed and activated
Administrator sessions on vulnerable WordPress installations

Discovery Timeline

2025-02-18 - CVE-2024-13684 published to the National Vulnerability Database
2026-04-08 - Last updated in NVD database

Technical Details for CVE-2024-13684

Vulnerability Analysis

The Reset plugin provides administrators with functionality to reset WordPress database tables to a clean state. The plugin exposes administrative reset operations through the reset_db_page() function. This function performs destructive database actions without verifying that the request originated from an authenticated administrator session.

The vulnerability falls under CWE-352 (Cross-Site Request Forgery). WordPress provides a nonce mechanism through wp_verify_nonce() and check_admin_referer() to defend against CSRF, but the affected function either omits or improperly implements these checks. As a result, the server accepts forged requests as legitimate administrative actions.

Root Cause

The reset_db_page() handler does not validate a WordPress nonce token before executing reset logic. Without nonce validation, the plugin cannot distinguish between an intentional administrator action and a request triggered by an attacker-controlled page. Any authenticated administrator visiting a malicious URL or page containing a crafted form submission will inadvertently execute the reset operation under their session.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts a page containing a hidden form or image tag that issues a request to the vulnerable plugin endpoint on a target WordPress site. The attacker then sends the link to a site administrator through phishing, social media, or a forum comment. When the authenticated administrator visits the attacker's page, the browser automatically attaches session cookies to the cross-site request. The plugin processes the request as authorized and resets the targeted database tables, including comments, themes, plugins, users, or full content.

No authentication is required from the attacker. The administrator's authenticated session supplies the necessary privileges. See the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2024-13684

Indicators of Compromise

Unexpected truncation or emptying of WordPress database tables such as wp_comments, wp_posts, wp_options, or wp_users
Sudden disappearance of installed themes or plugins from the WordPress admin dashboard
HTTP referer headers in webserver logs pointing to external untrusted domains immediately before reset operations
POST or GET requests to the Reset plugin endpoints originating from cross-origin contexts

Detection Strategies

Monitor WordPress audit logs for invocations of the reset_db_page() function and correlate them with administrator browser activity
Inspect webserver access logs for requests to Reset plugin URLs containing external referers
Alert on administrator-initiated state-changing requests that lack a corresponding prior admin panel navigation
Compare current database row counts against historical baselines to identify mass deletions

Monitoring Recommendations

Enable file integrity monitoring on the wp-content/plugins/reset/ directory
Forward WordPress and webserver logs to a centralized log analytics platform for correlation
Track administrator session activity, including referer headers and request origins, to flag CSRF patterns
Configure alerts for unexpected plugin or theme deactivation events recorded in the WordPress activity log

How to Mitigate CVE-2024-13684

Immediate Actions Required

Deactivate and remove the Reset plugin until a patched version is confirmed installed
Restore any affected WordPress database content from the most recent verified backup
Audit administrator accounts for signs of session abuse and force password resets where appropriate
Educate administrators to avoid clicking unverified links while logged into the WordPress admin panel

Patch Information

Review the WordPress Plugin Change Log for the official remediation commit. Upgrade to a Reset plugin version newer than 1.6 once the vendor publishes a fix that adds nonce validation to reset_db_page(). Confirm the patched version verifies nonces using check_admin_referer() or equivalent WordPress CSRF protections.

Workarounds

Uninstall the Reset plugin entirely if reset functionality is not required in production
Restrict access to /wp-admin/ endpoints by IP allowlisting at the webserver or WAF layer
Deploy a Web Application Firewall rule blocking requests to Reset plugin endpoints that lack a valid _wpnonce parameter
Use SameSite=Strict cookies for WordPress sessions to limit cross-site cookie attachment

bash

# Example Nginx rule to block requests to the Reset plugin lacking a nonce parameter
location ~* /wp-content/plugins/reset/ {
    if ($arg__wpnonce = "") {
        return 403;
    }
}