CVE-2024-8794mediumCWE-620

CVE-2024-8794: fallo de gravedad media en bookingalgorithms BA Book Everything

BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BA Book Everything

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.4%
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
bookingalgorithms · BA Book Everything
CVEs relacionadas — bookingalgorithms BA Book Everything

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-3672MEDIUMBA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-8795HIGHBA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account TakeoverEPSS 0.3%CVE-2024-47360HIGHWordPress BA Book Everything plugin <= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-102565HIGHBA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' ParameterEPSS 0.3%CVE-2026-96039HIGHBA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name ParameterEPSS 0.2%CVE-2026-39786HIGHWordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%