WPBookit WordPress Plugin Arbitrary User Password Change Vulnerability

A vulnerability allowing unauthenticated users to change passwords of any user, potentially leading to takeover of administrator accounts, exists in the WPBookit plugin for WordPress, in versions through 1.6.4. This issue arises from the plugin's authorization bypass, allowing users to manipulate access to objects and exploit system resources.

Impact

Exploitation of this vulnerability allows for unauthorized password changes, which could lead to unauthorized access to user accounts, including those of administrators.

Remediation

Users are advised to update the WPBookit plugin to version 1.6.6 or later.