CVE-2024-13677 Overview
CVE-2024-13677 is a privilege escalation vulnerability in the GetBookingsWP – Appointments Booking Calendar Plugin for WordPress. The flaw affects all versions up to and including 1.1.27. The plugin fails to validate a user's identity before updating account details, including email addresses. Authenticated attackers with subscriber-level access or higher can modify any user's email address, including administrators. Once an administrator's email is changed, the attacker triggers a password reset and takes over the account. This weakness is categorized as Missing Authorization [CWE-862].
Critical Impact
Any authenticated subscriber can take over WordPress administrator accounts, leading to full site compromise.
Affected Products
- Istmoplugins GetBookingsWP – Appointments Booking Calendar Plugin for WordPress
- All plugin versions up to and including 1.1.27
- WordPress sites running the vulnerable plugin with open user registration enabled
Discovery Timeline
- 2025-02-18 - CVE-2024-13677 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13677
Vulnerability Analysis
The vulnerability resides in the plugin's user management functionality inside classes/user.php. The account update handler accepts requests to modify user profile fields such as email addresses. It does not verify that the authenticated requester owns the target account or holds the capability to edit other users. An attacker with only subscriber-level access can submit crafted requests that specify an arbitrary user_id parameter and a new email address.
Because the plugin trusts the client-supplied identifier, WordPress commits the email change to the target account, including administrator accounts. The attacker then invokes the standard WordPress wp-login.php?action=lostpassword flow. WordPress dispatches the reset link to the attacker-controlled inbox, allowing full account takeover. The result is complete confidentiality, integrity, and availability loss for the WordPress site.
Root Cause
The root cause is missing authorization checks in the plugin's profile update endpoint. The code omits a current_user_can() capability check and does not compare the target user_id against get_current_user_id(). WordPress nonce checks alone do not enforce authorization — they only prevent cross-site requests. Without an ownership or capability check, any logged-in user can alter another user's stored email.
Attack Vector
Exploitation requires an authenticated session on the target WordPress site. Many sites running booking plugins allow open registration for customers, which lowers the barrier. The attacker registers or uses an existing subscriber account, sends a crafted POST request to the plugin's vulnerable action that updates the administrator's email, then triggers WordPress password recovery. Refer to the WordPress Plugin User Class source and the Wordfence Vulnerability Report for additional technical detail.
Detection Methods for CVE-2024-13677
Indicators of Compromise
- Unexpected changes to the user_email field for administrator accounts in the wp_users table.
- Password reset emails delivered to previously unassociated external email addresses.
- New administrator logins from IP addresses not previously seen for that account.
- Subscriber accounts sending POST requests to GetBookingsWP user update endpoints followed shortly by wp-login.php?action=lostpassword requests.
Detection Strategies
- Audit WordPress database changes to the user_email column and correlate with the acting session user.
- Enable WordPress activity logging plugins to record profile modifications and password reset events with source IP.
- Alert when any non-administrator session issues requests to plugin AJAX or REST endpoints that modify user records.
Monitoring Recommendations
- Monitor web server logs for requests to GetBookingsWP endpoints containing a user_id parameter that does not match the session owner.
- Track outbound password reset emails and flag deliveries to newly introduced email domains.
- Review administrator account email history weekly until the plugin is patched or removed.
How to Mitigate CVE-2024-13677
Immediate Actions Required
- Update the GetBookingsWP plugin to a version above 1.1.27 as soon as the vendor releases a fix.
- If no patched version is available, deactivate and remove the plugin from all affected WordPress installations.
- Force a password reset for all administrator and editor accounts and verify their email addresses have not been altered.
- Disable open user registration under Settings → General while investigating.
Patch Information
No vendor advisory URL is available in the NVD record at the time of publication. Site owners should check the plugin's WordPress.org page for a release above 1.1.27 and review the Wordfence Vulnerability Report for the latest remediation status.
Workarounds
- Restrict access to the plugin's user update endpoints using a web application firewall rule that blocks non-administrator sessions.
- Temporarily disable subscriber-level registration to reduce the pool of eligible attackers.
- Enforce two-factor authentication for all administrator accounts so a stolen password alone cannot grant access.
# Disable the vulnerable plugin via WP-CLI until a patched release is available
wp plugin deactivate get-bookings-wp
wp plugin delete get-bookings-wp
# Close open registration while investigating
wp option update users_can_register 0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
