CVE-2024-8795: BA Book Everything CSRF Vulnerability

CVE-2024-8795 Overview

CVE-2024-8795 is a Cross-Site Request Forgery (CSRF) vulnerability affecting the BA Book Everything plugin for WordPress in all versions up to and including 1.6.20. The flaw stems from missing or incorrect nonce validation in the my_account_update() function. Unauthenticated attackers can craft a malicious request that, when triggered by an authenticated user such as a site administrator, updates that user's account details. Attackers can leverage this to reset passwords and take over accounts, including administrator accounts, leading to full site compromise. The vulnerability is categorized under CWE-352.

Critical Impact
A successful CSRF attack allows attackers to reset an administrator's password and gain full control of the WordPress site.

Affected Products

BA Book Everything plugin for WordPress, all versions up to and including 1.6.20
WordPress installations with the vulnerable plugin activated
Sites where administrators can be lured to attacker-controlled links

Discovery Timeline

2024-09-24 - CVE-2024-8795 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-8795

Vulnerability Analysis

The vulnerability resides in the my_account_update() function within the plugin's account management logic. WordPress plugins are expected to validate a nonce token using functions such as check_admin_referer() or wp_verify_nonce() before processing state-changing requests. The BA Book Everything plugin either omits this validation or implements it incorrectly for the account update handler.

Because the account update endpoint accepts requests without a valid nonce, the browser of an authenticated victim will submit attacker-controlled parameters using the victim's session cookies. The endpoint processes the request as if the victim initiated it, updating stored account values such as email address or password.

Code paths referenced in the plugin source include the account handler in class-babe-my-account.php and user update logic in class-babe-users.php. Details are available in the Wordfence Vulnerability Analysis.

Root Cause

The root cause is the absence of proper CSRF token validation on a state-changing endpoint. Without a nonce check, the server cannot distinguish between a legitimate action initiated by the user and a forged cross-origin request submitted by the victim's browser.

Attack Vector

The attack requires user interaction. An attacker hosts a malicious page containing a hidden form or JavaScript that submits a POST request to the vulnerable WordPress endpoint. When an authenticated administrator visits the page or clicks a crafted link, the browser attaches valid session cookies. The plugin processes the forged request and updates account fields, allowing the attacker to reset the administrator's password and log in.

See the plugin code references at class-babe-my-account.php and class-babe-users.php for the vulnerable functions.

Detection Methods for CVE-2024-8795

Indicators of Compromise

Unexpected password reset or email address change events for administrator or subscriber accounts
POST requests to the plugin's account update endpoint originating from external Referer headers or lacking a valid nonce parameter
Administrator login sessions from unfamiliar IP addresses immediately after account detail changes
Presence of the BA Book Everything plugin at version 1.6.20 or earlier in the WordPress installation

Detection Strategies

Monitor WordPress audit logs for user profile updates that do not correlate with legitimate administrator activity
Inspect web server access logs for POST requests to endpoints handled by my_account_update() with third-party Referer values
Deploy a web application firewall rule to flag account update requests missing a valid WordPress nonce

Monitoring Recommendations

Enable WordPress activity logging plugins to record all user meta changes and password resets
Alert on account email changes followed by password reset requests within a short time window
Track plugin version inventory across managed WordPress sites and flag installations running 1.6.20 or below

How to Mitigate CVE-2024-8795

Immediate Actions Required

Update the BA Book Everything plugin to a version later than 1.6.20 if available, or deactivate and remove the plugin
Force a password reset for all administrator and privileged accounts on affected sites
Review recent user profile and password change events for signs of unauthorized modification
Restrict administrator browsing activity on untrusted sites and enforce session isolation

Patch Information

The fix is tracked in the WordPress plugin repository. Review the WordPress Changeset Overview for the code changes that introduce proper nonce validation. Site owners should upgrade to the latest available version of the plugin from the WordPress plugin directory.

Workarounds

Deactivate the BA Book Everything plugin until an updated version is installed
Deploy a web application firewall rule that blocks POST requests to the plugin's account update endpoint when a valid WordPress nonce is not present
Require administrators to use a dedicated browser profile for WordPress administration to reduce exposure to cross-site request forgery

bash

# Example WAF rule concept - block account update POSTs missing a nonce parameter
# ModSecurity pseudo-rule
SecRule REQUEST_METHOD "@streq POST" \
  "chain,deny,status:403,id:1008795,msg:'CVE-2024-8795 CSRF block'"
  SecRule REQUEST_URI "@contains babe_my_account_update" \
    "chain"
    SecRule &ARGS:_wpnonce "@eq 0"