CVE-2024-10215

Critical

Published: 09 January 2025

Published

09 January 2025

Modified

27 June 2025

KEV Added

—

Patch

—

CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0035 57.4th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-10215 is a critical-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Iqonic Wpbookit. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 42.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).

Threat & Defense at a Glance

What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces approved authorizations for access to system resources, directly countering the authorization bypass that allows unauthenticated attackers to change user passwords.

SI-10 Information Input Validation good match

prevent

Validates information inputs to prevent user-controlled keys from bypassing authorization checks and accessing password change functions.

SI-2 Flaw Remediation good match

prevent

Requires timely identification, reporting, and correction of flaws like this plugin vulnerability through patching to version beyond 1.6.4.

NVD Description

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This…

makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Deeper analysisAI

CVE-2024-10215 is an authorization bypass vulnerability in the WPBookit plugin for WordPress, affecting versions up to and including 1.6.4. The flaw, classified under CWE-639 (Authorization Bypass Through User-Controlled Key), stems from the plugin providing user-controlled access to objects, allowing attackers to bypass authorization checks and access system resources. It has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its network accessibility, low complexity, and lack of prerequisites.

Unauthenticated attackers can exploit this vulnerability remotely without user interaction. By leveraging the user-controlled object access, they can arbitrarily change passwords for any WordPress user, including administrators, potentially enabling full account takeover and unauthorized site control.

Advisories from Wordfence and the WPBookit plugin's change log provide details on the issue. Security practitioners should refer to these sources for patch information, with mitigation centered on updating to a version beyond 1.6.4.