PT-2025-29294 · WordPress · Wpbookit

Matthew Rollings · Published 2025-07-12 · Updated 2025-07-22 · CVE-2025-6058

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPBookit versions up to and including 1.0.4

Description The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image upload handle() function, which is triggered via the '/add booking type' route. This allows unauthenticated attackers to upload arbitrary files to the affected site's server, potentially leading to remote code execution.

Recommendations WPBookit versions up to and including 1.0.4: Update to version 1.0.5 or later to address the issue.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-6058

Affected Products

Wpbookit

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-6058 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6058 · Vendor Advisory
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314288%40wpbookit&new=3314288%40wpbookit&sfp_email=&sfph_mail= · Patch
• https://wordfence.com/threat-intel/vulnerabilities/id/1d779ad1-fdbe-444c-85c5-99146a1a03d8?source=cve · Note
• https://t.me/cvetracker/27620 · Telegram Post
• https://t.me/cvenotify/128680 · Telegram Post
• https://twitter.com/CveFindCom/status/1943893116555002193 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-booking-type-controller.php#L455 · Note
• https://twitter.com/cracbot/status/1945800693190725815 · Twitter Post
• https://twitter.com/pdnuclei_bot/status/1947567312510628236 · Twitter Post
• https://twitter.com/CVEnew/status/1943898117897666757 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1943914599746576621 · Twitter Post
• https://twitter.com/Nxploited/status/1944072796906119645 · Twitter Post