CVE-2024-8794 Overview
CVE-2024-8794 affects the BA Book Everything plugin for WordPress in all versions up to and including 1.6.20. The plugin exposes a reset_user_password() function that does not verify a user's identity before setting a new password. Unauthenticated attackers can reset the password of any user account, including administrators. The attacker does not receive the newly generated password, so direct privilege escalation is not possible. However, the flaw enables denial of access to legitimate users and supports account takeover attempts when combined with password disclosure paths. The issue is tracked under [CWE-620: Unverified Password Change].
Critical Impact
Unauthenticated attackers can reset arbitrary WordPress user passwords, including administrator accounts, causing account lockout and disruption of site operations.
Affected Products
- BA Book Everything plugin for WordPress
- All versions up to and including 1.6.20
- WordPress sites running the vulnerable ba-book-everything plugin
Discovery Timeline
- 2024-09-24 - CVE-2024-8794 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-8794
Vulnerability Analysis
The BA Book Everything plugin implements a password reset workflow inside class-babe-users.php. The reset_user_password() function accepts a target user identifier and writes a new password without validating that the request originated from the account owner. No nonce check, capability check, or ownership check gates the call. Because the endpoint is reachable without authentication, any remote attacker can trigger a password reset for arbitrary accounts.
The generated password is delivered through the standard account notification channel, so the attacker gains no direct knowledge of the new credential. The practical outcome is targeted account lockout: administrators, editors, and customers lose access until a legitimate reset is performed. Combined with mailbox compromise or interception, the flaw becomes an account takeover primitive.
Root Cause
The root cause is a missing identity verification step in the reset handler. The plugin relies on a request parameter to identify the target user rather than validating a signed reset token, session context, or WordPress capability. This maps to [CWE-620: Unverified Password Change], where the application allows a password change without confirming the requester's authorization.
Attack Vector
Exploitation requires only network access to the WordPress site and no authentication or user interaction. An attacker sends a crafted HTTP request to the plugin endpoint that invokes the reset routine, specifying a target account such as the site administrator. The server processes the request and overwrites the account's password with a value the attacker cannot read. See the WordPress Plugin User Class File and the Wordfence Vulnerability Report for the vulnerable code path.
No public proof-of-concept exploit is listed in ExploitDB, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-8794
Indicators of Compromise
- Unexpected WordPress password reset notification emails sent to administrator or high-privilege accounts.
- HTTP POST or GET requests targeting the BA Book Everything plugin endpoints that invoke reset_user_password().
- Sudden inability of legitimate users, especially administrators, to log in with known credentials.
- Bursts of anonymous requests to /wp-admin/admin-ajax.php or plugin-specific URLs referencing user IDs.
Detection Strategies
- Review the WordPress user_activity and mail logs for password reset events not initiated by the account owner.
- Correlate web server access logs with requests to ba-book-everything endpoints originating from unauthenticated sessions.
- Alert on plugin version fingerprints matching 1.6.20 or lower during external attack surface scans.
Monitoring Recommendations
- Enable WordPress audit logging to capture password change events with source IP and request context.
- Forward web server, PHP, and mail logs to a centralized platform for cross-source correlation.
- Monitor for repeated 200 responses to plugin endpoints from a single IP over short time windows.
How to Mitigate CVE-2024-8794
Immediate Actions Required
- Update the BA Book Everything plugin to a version later than 1.6.20 that contains the fix from WordPress Plugin Changeset 3152728.
- Deactivate and remove the plugin on sites that cannot upgrade immediately.
- Force a password reset for administrator and privileged accounts and verify email addresses on file are attacker-controlled free.
- Review recent password reset events and revoke active sessions for any account with an unexplained reset.
Patch Information
The vendor addressed the issue in a subsequent release. The fix is documented in the WordPress Plugin Changeset, which adds identity verification to the reset handler. Administrators should apply the update through the WordPress plugin management interface and confirm the installed version is above 1.6.20.
Workarounds
- Restrict access to the plugin endpoint at the web server or Web Application Firewall (WAF) layer until the patch is applied.
- Disable the BA Book Everything plugin if it is not actively used on the site.
- Enforce two-factor authentication (2FA) on administrator accounts to blunt any downstream takeover attempt.
# Update the plugin using WP-CLI
wp plugin update ba-book-everything
# Verify installed version is above 1.6.20
wp plugin get ba-book-everything --field=version
# If no fixed version is deployable, deactivate the plugin
wp plugin deactivate ba-book-everything
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
