CVE-2024-10215 WPBookit <= 1.6.4 - Unauthenticated Arbitrary User Password Change

What is CVE-2024-10215?

CVE-2024-10215 is a critical authentication bypass vulnerability in Iqonic Design WPBookit, published on 9 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.4. This is due to the plugin providing user-controlled access to objects, letting a user bypass authorization and access system resources. This makes it possible for unauthenticated attackers to change user passwords and potentially take over administrator accounts.

Weakness: CWE-639

Which versions are affected by CVE-2024-10215?

It affects 1 product.

Products include Iqonic Wpbookit.

How do I fix CVE-2024-10215?

No fix has been published for CVE-2024-10215 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2024-10215 being exploited?

There is no known exploitation of CVE-2024-10215 in the wild and no public exploit code.

Other vulnerabilities in Iqonic Design WPBookit

• CVE-2025-6058 WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2025-3810 WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover Critical 9.8
• CVE-2025-3811 WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update Critical 9.8
• CVE-2025-0357 WPBookit <= 1.6.9 - Unauthenticated Arbitrary File Upload Critical 9.8
• CVE-2024-54280 WordPress WPBookit plugin <= 1.6.0 - SQL Injection vulnerability Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-wrj5-h97x-2xcg.