CVE-2024-8794 – The BA Book Everything WordPress plugin has an ... (How to Fix)

Q: What is the severity of CVE-2024-8794?

CVE-2024-8794 has a CVSS score of 5.3 (MEDIUM). The BA Book Everything WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to reset any user's password without verification. This affects all WordPress sites using plugin versions up to 1.6.20. While attackers cannot access the generated passwords, they can disrupt site operations by locking legitimate users out.

📋 TL;DR

The BA Book Everything WordPress plugin has an authentication bypass vulnerability that allows unauthenticated attackers to reset any user's password without verification. This affects all WordPress sites using plugin versions up to 1.6.20. While attackers cannot access the generated passwords, they can disrupt site operations by locking legitimate users out.

💻 Affected Systems

Products:

BA Book Everything WordPress Plugin

Versions: All versions up to and including 1.6.20

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Affects all WordPress installations with the vulnerable plugin version enabled, regardless of configuration.

📦 What is this software?

Ba Book Everything by Ba Booking

View all CVEs affecting Ba Book Everything →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Administrator accounts get locked out, causing complete site management disruption and potential business impact if administrators cannot access critical functions.

🟠

Likely Case

Regular users experience account lockouts and service disruption, requiring manual password resets and generating support tickets.

🟢

If Mitigated

With proper monitoring and incident response, impact is limited to temporary user inconvenience and minor administrative overhead.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and the vulnerability requires no authentication, making all exposed instances vulnerable.

🏢 Internal Only: LOW - This primarily affects internet-facing WordPress installations; internal-only deployments are less likely to be targeted.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

The vulnerability is simple to exploit with basic HTTP requests targeting the password reset function without authentication.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.6.21 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3152728/ba-book-everything/trunk/includes/class-babe-users.php

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find 'BA Book Everything' and check if update is available. 4. Click 'Update Now' to upgrade to version 1.6.21 or later. 5. Verify plugin is active and functioning.

🔧 Temporary Workarounds

Disable Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate ba-book-everything

Restrict Access

all

Use web application firewall to block requests to vulnerable endpoints

🧯 If You Can't Patch

Implement rate limiting on password reset endpoints to prevent mass exploitation
Enable detailed logging of password reset attempts and monitor for suspicious activity

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin panel → Plugins → Installed Plugins for BA Book Everything version. If version is 1.6.20 or lower, you are vulnerable.

Check Version:

wp plugin get ba-book-everything --field=version

Verify Fix Applied:

After updating, verify plugin version shows 1.6.21 or higher in WordPress admin panel.

📡 Detection & Monitoring

Log Indicators:

Unusual volume of password reset requests
Password reset attempts from unexpected IP addresses
User complaints about being locked out

Network Indicators:

HTTP POST requests to /wp-admin/admin-ajax.php with action=reset_user_password
Multiple password reset attempts without preceding login attempts

SIEM Query:

source="wordpress.log" AND ("reset_user_password" OR "password reset" OR "babe_users") AND status=200

📊 Metadata

CVE ID: CVE-2024-8794

CVSS v3 Score: 5.3 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CWE: CWE-620

Published: September 24, 2024

Last Updated: September 26, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-8794, you might also want to check these: