CVE-2023-2834: Stylemixthemes BookIt Auth Bypass Flaw

CVE-2023-2834 Overview

The BookIt plugin for WordPress, developed by StylemixThemes, contains a critical authentication bypass vulnerability in versions up to and including 2.3.7. This flaw stems from insufficient verification of user identity during the appointment booking process. An unauthenticated attacker who knows or can guess a valid user's email address can exploit this vulnerability to log in as any existing user on the WordPress site, including administrators.

Critical Impact

Unauthenticated attackers can bypass authentication and gain full administrative access to WordPress sites running vulnerable versions of the BookIt plugin, leading to complete site compromise.

Affected Products

• StylemixThemes BookIt plugin for WordPress versions up to and including 2.3.7
• WordPress installations using the vulnerable BookIt plugin
• Any WordPress site with BookIt appointment booking functionality enabled

Discovery Timeline

• June 30, 2023 - CVE-2023-2834 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-2834

Vulnerability Analysis

This authentication bypass vulnerability (CWE-306: Missing Authentication for Critical Function) allows attackers to completely circumvent WordPress authentication mechanisms through the BookIt plugin's appointment booking workflow. The vulnerability exists in the CustomerController.php and Customers.php files within the plugin, where user authentication during the booking process fails to properly validate that the requesting user has the authority to act as the specified email account holder.

The attack is particularly dangerous because it requires no special privileges or user interaction. An attacker operating remotely over the network only needs to know or discover a valid email address associated with a WordPress user account on the target site. This information can often be obtained through user enumeration, public profiles, or simply guessing common administrator email formats.

Root Cause

The root cause of CVE-2023-2834 lies in the plugin's CustomerController.php handling of booking requests. When a user initiates an appointment booking, the system accepts an email address as a parameter but fails to verify that the requesting party actually controls or has authorization to use that email address. The database lookup in Customers.php retrieves user records based solely on the provided email without additional authentication checks, allowing any unauthenticated visitor to assume the identity of existing users.

Attack Vector

The attack exploits the network-accessible booking endpoint that processes appointment requests. An attacker submits a crafted booking request containing the email address of a target user (such as an administrator). Due to the missing authentication verification, the system processes this request as if it originated from the legitimate account holder, establishing an authenticated session for the attacker with the target user's privileges.

The exploitation flow involves:

1. Identifying a target WordPress site running a vulnerable BookIt version
2. Obtaining or guessing a valid user email address (administrator emails are high-value targets)
3. Submitting a booking request through the plugin's appointment functionality with the target email
4. Receiving an authenticated session with the target user's full privileges

For detailed technical analysis, refer to the Wordfence Blog on Authentication Bypass and the vulnerable code in CustomerController.php.

Detection Methods for CVE-2023-2834

Indicators of Compromise

• Unexpected administrator logins or session activity from unfamiliar IP addresses
• Anomalous booking requests containing administrator or privileged user email addresses
• Multiple booking attempts using different email addresses from the same source IP
• New user sessions created without corresponding login form submissions

Detection Strategies

• Monitor WordPress authentication logs for session creation events that bypass the standard login workflow
• Implement Web Application Firewall (WAF) rules to detect and alert on booking requests with email addresses matching administrative users
• Deploy anomaly detection for the BookIt plugin's booking endpoints to identify unusual request patterns
• Review access logs for direct requests to BookIt API endpoints from external sources

Monitoring Recommendations

• Enable comprehensive logging for the BookIt plugin's booking functionality
• Configure alerts for privilege escalation events or unexpected administrative access patterns
• Implement real-time monitoring of WordPress user session creation events
• Track and baseline normal booking request volumes to detect enumeration or brute-force attempts

How to Mitigate CVE-2023-2834

Immediate Actions Required

• Update the BookIt plugin to a version newer than 2.3.7 immediately
• Audit WordPress user accounts and active sessions for any unauthorized access
• Review booking logs for suspicious activity or exploitation attempts
• Consider temporarily disabling the BookIt plugin until patching is complete

Patch Information

StylemixThemes has released patches addressing this vulnerability. The fixes are documented in WordPress Plugin Changeset 2919529 and WordPress Plugin Changeset 2925153. Update to the latest version of BookIt through the WordPress plugin repository to apply these security fixes.

For additional vulnerability intelligence, consult the Wordfence Vulnerability Intel Report and the Lana Codes Vulnerability Database Entry.

Workarounds

• Restrict access to the BookIt booking functionality using .htaccess rules or server-level access controls until patching is possible
• Implement additional authentication layers such as CAPTCHA or email verification for booking submissions
• Use a Web Application Firewall to filter requests to BookIt endpoints and block suspicious patterns
• Temporarily disable public booking functionality if the plugin cannot be immediately updated

# Apache .htaccess example to restrict BookIt endpoint access
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php$ [NC]
    RewriteCond %{QUERY_STRING} action=bookit [NC]
    RewriteCond %{REMOTE_ADDR} !^192\.168\.1\. 
    RewriteRule ^ - [F,L]
</IfModule>