CVE-2024-8794 json
BA Book Everything <= 1.6.20 - Unauthenticated Arbitrary User Password Reset
published 2024-09-24 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-49424
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 38%
- public exploits
- 0
- none known
Summary
The BA Book Everything plugin for WordPress is vulnerable to arbitrary password reset in all versions up to, and including, 1.6.20. This is due to the reset_user_password() function not verifying a user's identity prior to setting a password. This makes it possible for unauthenticated attackers to reset any user's passwords, including administrators. It's important to note that the attacker will not have access to the generated password, therefore, privilege escalation is not possible.
Patch / fix
- ba-booking ba_book_everything 1.6.21
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.43% chance of exploitation in the next 30 days, higher than 38% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected products
- bookingalgorithms BA Book Everything
- booking_algorithms ba_book_everything
Classification
- Weakness
-
- CWE-620 Unverified Password Change
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset/3152728/ba-book-everything/trunk/includes/class-babe-users.php
patch
-
wordfence.com
/threat-intel/vulnerabilities/id/4e261b0e-5ca3-4f5c-acc0-41abee31b148?source=cve
third-party-advisory
-
plugins.trac.wordpress.org
/browser/ba-book-everything/tags/1.6.20/includes/class-babe-users.php#L266
product
-
plugins.trac.wordpress.org
/browser/ba-book-everything/tags/1.6.20/includes/class-babe-my-account.php#L610
product
Sources
- CVE List CVE-2024-8794
- NVD CVE-2024-8794
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.