PT-2025-1579 · WordPress · Wpbookit

István Márton · Published 2025-01-09 · Updated 2025-06-27 · CVE-2024-10215

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPBookit plugin for WordPress versions up to, and including, 1.6.4

Description The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Recommendations For WPBookit plugin for WordPress versions up to, and including, 1.6.4, update to a version later than 1.6.4 to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the WordPress installation to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-10215

Affected Products

Wpbookit

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2024-10215 · Security Note
• https://osv.dev/vulnerability/CVE-2024-10215 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1877438206125179067 · Twitter Post
• https://twitter.com/CVEnew/status/1877439463913357650 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2d23a2b9-8476-4564-a5de-5e6cfc38ce68?source=cve · Note
• https://twitter.com/CVETracker/status/1877807814132789315 · Twitter Post
• https://t.me/cvenotify/124769 · Telegram Post
• https://t.me/cvenotify/126933 · Telegram Post
• https://documentation.iqonic.design/wpbookit/versions/change-log · Note