CVE-2024-10215
Published: 09 January 2025
Summary
CVE-2024-10215 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Iqonic Wpbookit. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 34.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2024-10215 is an authorization bypass vulnerability in the WPBookit plugin for WordPress, affecting versions up to and including 1.6.4. The flaw, classified under CWE-639 (Authorization Bypass Through User-Controlled Key), stems from the plugin providing user-controlled access to objects, allowing attackers to bypass authorization checks and access system resources. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.
Unauthenticated attackers can exploit this vulnerability remotely without user interaction. By leveraging the user-controlled object access, they can arbitrarily change passwords for any WordPress user, including administrators, potentially enabling full account takeover and unauthorized site control.
Advisories from Wordfence and the WPBookit plugin's change log provide details on the issue. Security practitioners should refer to these sources for patch information, with mitigation centered on updating to a version beyond 1.6.4.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-33578
Vulnerability details
The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This…
more
makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote exploitation of public-facing WordPress plugin (T1190) enabling unauthorized password changes and account takeover (T1098).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforces approved authorizations for access to system resources, directly countering the authorization bypass that allows unauthenticated attackers to change user passwords.
Validates information inputs to prevent user-controlled keys from bypassing authorization checks and accessing password change functions.
Requires timely identification, reporting, and correction of flaws like this plugin vulnerability through patching to version beyond 1.6.4.