Cross-Site Request Forgery Vulnerability in BA Book Everything Plugin

CVE-2024-8795

Summary

The BA Book Everything plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit Cross-Site Request Forgery. This flaw exists in all versions up to and including 1.6.20, stemming from inadequate nonce validation in the my_account_update() function. Attackers can potentially manipulate a site administrator into triggering an action, such as clicking on a deceptive link, which could lead to unauthorized updates to user account details. Exploiting this vulnerability may enable an attacker to reset a user's password, providing them unauthorized access to accounts.

References