PT-2025-27855 · WordPress · Booking X

Kenneth Dunn · Published 2025-07-04 · Updated 2025-07-20 · CVE-2025-6814

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Booking X plugin for WordPress versions 1.0 through 1.1.2

Description: The issue allows unauthorized access to data due to a missing capability check on the export now() function. This enables unauthenticated attackers to download all plugin data, including user accounts, user meta, and PayPal credentials, by issuing a crafted POST request to a vulnerable API endpoint.

Recommendations: For versions 1.0 through 1.1.2, as a temporary workaround, consider disabling the export now() function until a patch is available. Restrict access to the plugin's data export functionality to minimize the risk of exploitation. Avoid using the plugin until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-6814

Affected Products

Booking X

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-6814 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/6a30d572-e086-4b83-8cb7-4cef9a3253bd?source=cve · Note
• https://twitter.com/jmdevlabs/status/1947018372685664743 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1940998467259703368 · Twitter Post
• https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/admin/class-bookingx-admin.php#L784 · Note
• https://wordpress.org/plugins/booking-x/#developers · Note
• https://twitter.com/cracbot/status/1942901594686984677 · Twitter Post
• https://t.me/cvenotify/127694 · Telegram Post
• https://plugins.trac.wordpress.org/browser/booking-x/tags/1.1.2/includes/class-bookingx.php#L322 · Note