Critical · published May 9, 2025
🚨 A privilege escalation vulnerability lurks in the WPBookit plugin, allowing attackers to change ANY user's email and password without breaking a sweat! 🔥 Think of it as a hotel where someone can simply walk up to the front desk and change the room key without showing any ID—chaos could ensue! This flaw could lead to unauthorized access for any user, including administrators, letting attackers wreak havoc by taking control of accounts, accessing sensitive data, or even locking out legitimate users. It’s absolutely devastating for any website relying on this plugin!
Think of it as a hotel where someone can simply walk up to the front desk and change the room key without showing any ID—chaos could ensue! The WPBookit plugin fails to adequately validate user identities when updating profile information, allowing unauthenticated attackers to hijack accounts through the edit_profile_data() function.
This flaw could lead to unauthorized access for any user, including administrators, letting attackers wreak havoc by taking control of accounts, accessing sensitive data, or even locking out legitimate users. It’s absolutely devastating for any website relying on this plugin! Immediately update the WPBookit plugin to version 1.0.3 or later to close this vulnerability. Additionally, consider conducting a security audit to ensure that user identity validation is robust across your site. Don't wait! You've got this! Follow these steps and you'll be back on the path to a secure site in no time! 🛡️