PT-2023-21662 · WordPress · Bookit

István Márton + 1 · Published 2023-06-22 · Updated 2023-07-06 · CVE-2023-2834

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BookIt plugin for WordPress versions up to, and including, 2.3.7

Description The BookIt plugin for WordPress has an authentication bypass issue due to insufficient verification of the user being supplied during booking an appointment through the plugin. This allows unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email. The plugin provides a shortcode 'bookit' for embedding a booking calendar into a WordPress site page. By using this functionality, after selecting a date and time in the calendar, it is possible to book an appointment by specifying a name, email address, and password for registration. The plugin checks the user ID based on the email address specified through the email parameter. If the email belongs to an existing WordPress user, it associates the request with that user and sets authentication cookies for them. Unfortunately, this functionality was implemented insecurely, as it does not include any authentication checks, such as password verification. It simply looks for identity and allows the action without proper verification and authentication. This gives attackers the ability to bypass authentication and gain access to arbitrary accounts on sites with the vulnerable plugin version.

Recommendations For BookIt plugin for WordPress versions up to, and including, 2.3.7, update to a version that includes the fix for this issue. As a temporary workaround, consider disabling the booking functionality through the 'bookit' shortcode until a patch is available. Restrict access to the booking calendar to minimize the risk of exploitation. Avoid using the email parameter in the booking functionality until the issue is resolved.

Exploit

Fix

Authentication Bypass Using an Alternate Path or Channel

Missing Authentication

Weakness Enumeration

CWE-288

CWE-306

Related Identifiers

CVE-2023-2834

Affected Products

Bookit

References · 12

• 🔥 https://wordfence.com/blog/2023/06/stylemixthemes-addresses-authentication-bypass-vulnerability-in-bookit-wordpress-plugin · Exploit
• 🔥 https://lana.codes/lanavdb/0dea1346-fd60-4338-8af6-6f89c29075d4 · Exploit
• https://osv.dev/vulnerability/CVE-2023-2834 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset/2925153/bookit · Patch
• https://plugins.trac.wordpress.org/changeset/2919529/bookit · Patch
• https://plugins.trac.wordpress.org/browser/bookit/tags/2.3.6/includes/classes/database/Customers.php#L63 · Patch
• https://plugins.trac.wordpress.org/browser/bookit/tags/2.3.6/includes/classes/CustomerController.php#L27 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-2834 · Security Note
• https://t.me/cvenotify/53808 · Telegram Post
• https://t.me/cvenotify/53362 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/cfd32e46-a4fc-4c10-b546-9f9da75db791?source=cve · Note
• https://t.me/poxek/2993 · Telegram Post