The Database Reset WordPress plugin suffers from a CSRF vulnerability due to improper nonce validation in the install_wpr() function. This flaw enables attackers to perform unauthorized actions by forging requests that rely on a site administrator's interaction, such as clicking a crafted link. The vulnerability affects all versions up to 3.22 and can lead to the unauthorized installation of the WP Reset Plugin. The CVSS 3.1 base score is 4.7, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, no confidentiality impact, limited integrity impact, and no availability impact.

An attacker can exploit this vulnerability to cause a site administrator to unknowingly install the WP Reset Plugin through a forged request. This could lead to limited integrity impact on the affected WordPress site. There is no direct confidentiality or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution with unsolicited links and avoid clicking on suspicious URLs. Monitoring for updates from the plugin vendor or WordPress security advisories is recommended to apply any forthcoming patches promptly.