CVE-2024-13146
📋 TL;DR
The Booknetic WordPress plugin before version 4.1.5 lacks CSRF protection when creating Staff accounts, allowing attackers to trick logged-in administrators into adding unauthorized staff members via malicious requests. This affects WordPress sites using vulnerable versions of the Booknetic plugin.
💻 Affected Systems
- Booknetic WordPress plugin
📦 What is this software?
Booknetic by Fs Code
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create administrative staff accounts with full privileges, leading to complete site compromise, data theft, or malware injection.
Likely Case
Attackers create staff accounts with limited privileges to maintain persistence, monitor activities, or escalate privileges later.
If Mitigated
With proper CSRF protections and user awareness, exploitation attempts fail, preventing unauthorized account creation.
🎯 Exploit Status
Exploitation requires social engineering to trick an admin, but the technical execution is straightforward once the admin is targeted.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.5
Vendor Advisory: https://wpscan.com/vulnerability/19cb40dd-53b0-46db-beb0-1841e385ce09/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Booknetic and update to version 4.1.5 or later. 4. Verify update completes successfully.
🔧 Temporary Workarounds
Implement CSRF Protection Manually
allAdd custom CSRF tokens to staff creation forms if patching is delayed.
Disable Plugin Temporarily
WordPressDeactivate Booknetic plugin until patched to prevent exploitation.
wp plugin deactivate booknetic
🧯 If You Can't Patch
- Restrict admin access to trusted networks only to reduce exposure to CSRF attacks.
- Educate administrators about phishing risks and advise against clicking untrusted links while logged in.
🔍 How to Verify
Check if Vulnerable:
Check the Booknetic plugin version in WordPress admin under Plugins > Installed Plugins. If version is below 4.1.5, it is vulnerable.Check Version:
wp plugin get booknetic --field=versionVerify Fix Applied:
After updating, confirm the Booknetic plugin version is 4.1.5 or higher in the WordPress admin plugins list.📡 Detection & Monitoring
Log Indicators:
- Unexpected staff account creation events in WordPress logs
- Multiple failed login attempts followed by new staff account creation
Network Indicators:
- HTTP POST requests to /wp-admin/admin-ajax.php with action=booknetic_create_staff from untrusted sources
SIEM Query:
source="wordpress.log" AND "booknetic" AND "create_staff"