CVE-2024-8795 is a CSRF vulnerability in the BA Book Everything WordPress plugin affecting all versions up to 1.6.20. The issue arises from missing or incorrect nonce validation in the my_account_update() function, enabling unauthenticated attackers to perform state-changing actions on behalf of authenticated users if they can trick them into clicking a malicious link. This can result in account takeover through password reset. The vulnerability is network exploitable with low attack complexity and requires user interaction. Confidentiality, integrity, and availability impacts are all rated high.

Successful exploitation allows an attacker to update user account details, including resetting passwords, leading to unauthorized account access. This compromises user confidentiality and integrity and can disrupt availability by altering account settings. The vulnerability affects site administrators and potentially all users whose accounts can be targeted via the plugin's vulnerable function.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling the plugin or restricting access to the affected functionality. Implementing additional CSRF protections or nonce validation at the application level may mitigate risk. Avoid clicking suspicious links and educate administrators about the risk of CSRF attacks.