The Reset Database plugin for WordPress, versions up to and including 1.1.3, contains a privilege escalation vulnerability. The flaw arises from the process_reset() function being triggered without proper capability checks, combined with a nonce that is computed but unused, and a gating condition that allows the reset process if no administrator named 'admin' exists. Additionally, the identity verification checks the attacker's own password rather than an administrator's, enabling authenticated users with subscriber-level access or higher to reset the database, become the sole administrator, and delete the uploads directory.