CVE-2024-13677 is a missing authorization vulnerability (CWE-862) in the GetBookingsWP plugin for WordPress. The plugin fails to properly validate the identity of users before allowing updates to sensitive account details like email addresses. This flaw allows authenticated attackers with low-level privileges to escalate their privileges by changing other users' email addresses, including administrators, and subsequently resetting their passwords to gain unauthorized access. The vulnerability affects all versions up to and including 1.1.27 and has a CVSS 3.1 base score of 8.8, indicating high severity.

Successful exploitation allows an attacker with subscriber-level access or higher to take over any user account by changing the email address and resetting the password. This compromises confidentiality, integrity, and availability of user accounts, including administrative accounts, potentially leading to full site compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber-level access to trusted users only and monitor for suspicious account changes. Avoid using vulnerable versions of the plugin if possible.