PT-2025-12858 · WordPress · Booknetic

Veshraj Ghimire · Published 2025-03-26 · Updated 2025-04-30 · CVE-2024-13146

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Booknetic WordPress plugin versions prior to 4.1.5

Description The issue concerns a lack of CSRF check when creating Staff accounts, which could allow attackers to make logged-in admins add arbitrary Staff members via a CSRF attack. This could potentially be exploited by attackers to add unauthorized staff members.

Recommendations For versions prior to 4.1.5, update to version 4.1.5 or later to resolve the issue. As a temporary workaround, consider restricting access to the Staff account creation feature to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2024-13146

Affected Products

Booknetic

References · 8

• 🔥 https://wpscan.com/vulnerability/19cb40dd-53b0-46db-beb0-1841e385ce09 · Exploit
• https://osv.dev/vulnerability/CVE-2024-13146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-13146 · Security Note
• https://t.me/cvetracker/19935 · Telegram Post
• https://t.me/cvedetector/21152 · Telegram Post
• https://twitter.com/CVEnew/status/1904787203298832534 · Twitter Post
• https://t.me/cvenotify/116276 · Telegram Post
• https://t.me/cvenotify/120362 · Telegram Post