CVE-2024-8794

BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset

2024-09-23 00:00
wesley (wcraft)

Strategic Overview

Status
Patched in 1.6.21
Affected Plugin
BA Book Everything
Affected Version
<= 1.6.20
CVSS
5.3Medium
Weakness type
CWE-620 · Unverified Password Change
CVE
CVE-2024-8794
View all BA Book Everything vulnerabilities

At a glance

CVE-2024-8794 is a medium-severity Unverified Password Change vulnerability in the BA Book Everything WordPress plugin, affecting versions <= 1.6.20. It carries a CVSS score of 5.3 (reachable over the network; low attack complexity). Exploitation requires no authentication. The issue is fixed in version 1.6.21; sites on affected versions should update now. Disclosed September 2024, reported by wesley (wcraft).

Vulnerability Overview

The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.

Technical Analysis

The vector marks this flaw as remotely reachable over the network, with low attack complexity — no special timing or configuration is needed, and no privileges on the target site, and no interaction from a victim user.

CWE-620: Unverified Password Change

BA Book Everything <= 1.6.20 carries this weakness at reset_user_password(), and reaching it takes no account at all. Unverified password change means the password-update path does not require proof that the requester is the account owner.

An attacker who can reach the endpoint takes over the account outright, and the legitimate owner is locked out of it. For BA Book Everything the fix is 1.6.21: builds <= 1.6.20 are affected, anything from 1.6.21 onward is not.

Remediation

Update to version 1.6.21, or a newer patched version

How does WordSec protect against this?

This one needs no account at all, which puts it outside what login hardening can reach; WordSec's login security narrows the account-level paths around it, and the firewall is what inspects the request itself. None of that substitutes for the fix: BA Book Everything 1.6.21 closes this, and updating the plugin is the step that ends it.

  • Login Security
  • Alerts

External References

https://www.cve.org/CVERecord?id=CVE-2024-8794https://www.wordfence.com/threat-intel/vulnerabilities/id/4e261b0e-5ca3-4f5c-acc0-41abee31b148https://nvd.nist.gov/vuln/detail/CVE-2024-8794

Related records

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C