PT-2025-30633 · WordPress · Wpbookit

Youcef Hamdani · Published 2025-07-24 · Updated 2025-08-08 · CVE-2025-7852

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WPBookit versions prior to 1.0.7

Description The WPBookit plugin for WordPress is susceptible to arbitrary file uploads due to a lack of file type validation in the image upload handle() function. This function is connected via the 'add new customer' route. The plugin uses move uploaded file() on client-supplied files without restricting allowed extensions or MIME types, or sanitizing the filename. This allows unauthenticated attackers to upload arbitrary files to the affected server, potentially leading to remote code execution.

Recommendations WPBookit versions prior to 1.0.7: Update to version 1.0.7 or later.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-7852

Affected Products

Wpbookit

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-7852 · Security Note
• https://twitter.com/CveFindCom/status/1948241774255784078 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3331165 · Note
• https://twitter.com/CVEnew/status/1948245086539522426 · Twitter Post
• https://wordpress.org/plugins/wpbookit/#developers · Note
• https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php#L362 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=cve · Note
• https://twitter.com/jmdevlabs/status/1953845598378934539 · Twitter Post
• https://twitter.com/cracbot/status/1950149344818040938 · Twitter Post