WPBookit WordPress Plugin Privilege Escalation Vulnerability via Account Takeover

A privilege escalation vulnerability allowing account takeover has been identified in the WPBookit plugin for WordPress, affecting all versions through 1.0.2. The issue arises because the plugin fails to properly validate a user's identity before allowing changes to profile details such as passwords and email addresses. This flaw enables unauthenticated attackers to modify the email and password of any user, including administrators, potentially leading to unauthorized access to their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including those of administrators, by changing their email addresses and passwords.

Remediation

Users are advised to update the WPBookit plugin to version 1.0.3 or a newer patched version.