The WPBookit WordPress plugin up to version 1.0.2 contains an insecure direct object reference that allows an unauthenticated attacker to influence the edit_profile_data() routine. Because the plugin fails to verify the identity of the requesting user before applying changes to a profile, an attacker can modify any user’s email address or password, including those of administrators. This flaw enables full account takeover and thus elevates the attacker’s privileges across the site.

All installations of the WPBookit plugin from any version through 1.0.2, distributed by iqonicdesign and including the free WordPress edition, are affected regardless of other WordPress components or hosting environments. Any WordPress site that has loaded this plugin is impacted.

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is below 1 %, suggesting exploitation attempts are currently rare but still plausible. It is not currently listed in the CISA KEV catalog. Attackers can exploit this flaw remotely from any network location with internet access to the WordPress site, without needing prior authentication. The path requires only an HTTP request that triggers the edit_profile_data() method, which is publicly accessible. The lack of authentication and authorization checks makes the attack straightforward once the endpoint is identified.