The WPBookit plugin contains an insecure direct object reference that allows any unauthenticated user to submit a request to update another user’s email address. Because the plugin fails to verify the caller’s identity, an attacker can change the email of any account, including administrators, and then use that address to reset the password and assume the victim’s identity. This flaw provides a clear path to full account takeover for the targeted user.

All installations of the WPBookit WordPress plugin with version number 1.0.2 or earlier. The vulnerable component is the edit_newdata_customer_callback() function located in the core/admin classes for the plugin.

The CVSS base score of 9.8 indicates critical severity, but the EPSS score of less than 1% implies the likelihood of exploitation is low at present, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be via a crafted HTTP request to the plugin’s admin interface; the flaw requires no prior authentication, so the path is straightforward once the attacker locates the vulnerable endpoint.