CVE-2024-10215
📋 TL;DR
The WPBookit WordPress plugin vulnerability allows unauthenticated attackers to change any user's password, including administrators, by bypassing authorization checks. This affects all WordPress sites using WPBookit versions 1.6.4 and earlier. Attackers can take over accounts and gain administrative access to vulnerable websites.
💻 Affected Systems
- WPBookit WordPress Plugin
📦 What is this software?
Wpbookit by Iqonic
⚠️ Risk & Real-World Impact
Worst Case
Complete site takeover where attackers gain administrator access, install backdoors, steal data, deface the site, or use it for further attacks.
Likely Case
Administrator account compromise leading to site defacement, malware injection, or data theft.
If Mitigated
Limited impact if strong monitoring detects unusual password change activity and administrators can quickly regain control.
🎯 Exploit Status
Public exploit details are available, and the attack requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 1.6.5 or later
Vendor Advisory: https://documentation.iqonic.design/wpbookit/versions/change-log
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find WPBookit and update to version 1.6.5 or later. 4. If auto-update is available, enable it.
🔧 Temporary Workarounds
Disable WPBookit Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate wpbookit
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized password change requests
- Enable strong monitoring for unusual password reset activities and administrator account changes
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for WPBookit version 1.6.4 or earlier.Check Version:
wp plugin get wpbookit --field=versionVerify Fix Applied:
Confirm WPBookit plugin version is 1.6.5 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual password change requests, especially for administrator accounts from unauthenticated users
- Multiple failed login attempts followed by successful password reset
Network Indicators:
- HTTP POST requests to WPBookit endpoints with password change parameters from unauthenticated sources
SIEM Query:
source="wordpress.log" AND ("password_change" OR "wpbookit") AND status=200 AND user="-"