PT-2025-1579 · WordPress · Wpbookit

István Márton · Publicado 2025-01-09 · Atualizado 2025-06-27 · CVE-2024-10215

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPBookit plugin for WordPress versions up to, and including, 1.6.4

Description The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Recommendations For WPBookit plugin for WordPress versions up to, and including, 1.6.4, update to a version later than 1.6.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the WordPress installation to minimize the risk of exploitation.

Correção

IDOR

Enumeração de Fraquezas

CWE-639

Identificadores relacionados

CVE-2024-10215

Produtos afetados

Wpbookit

Referências · 9

• https://twitter.com/CveFindCom/status/1877438206125179067 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1877439463913357650 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2024-10215 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/2d23a2b9-8476-4564-a5de-5e6cfc38ce68?source=cve · Nota
• https://twitter.com/CVETracker/status/1877807814132789315 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2024-10215 · Aviso do Fabricante
• https://t.me/cvenotify/124769 · Publicação no Telegram
• https://t.me/cvenotify/126933 · Publicação no Telegram
• https://documentation.iqonic.design/wpbookit/versions/change-log · Nota