CVE-2024-8795highCWE-352

CVE-2024-8795: fallo de gravedad alta en bookingalgorithms BA Book Everything

BA Book Everything <= 1.6.20 - Cross-Site Request Forgery to Email Address Update/Account Takeover

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear BA Book Everything

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

21Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 8.8epss 0.3%
The BA Book Everything plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.6.20. This is due to missing or incorrect nonce validation on the my_account_update() function. This makes it possible for unauthenticated attackers to update a user's account details via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be leveraged to reset a user's password and gain access to their account.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Productos afectados
bookingalgorithms · BA Book Everything
CVEs relacionadas — bookingalgorithms BA Book Everything

En el mismo producto, de las más peligrosas a las menos.

CVE-2024-8794MEDIUMBA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password ResetEPSS 0.4%CVE-2024-3672MEDIUMBA Book Everything <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.3%CVE-2024-47360HIGHWordPress BA Book Everything plugin <= 1.6.20 - Reflected Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-102565HIGHBA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' ParameterEPSS 0.3%CVE-2026-96039HIGHBA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name ParameterEPSS 0.2%CVE-2026-39786HIGHWordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.2%