PT-2025-50919 · WordPress · Bookit Wordpress Plugin

Khaled Alenazi · CVE-2025-12841 · Published 2025-12-12 · Updated 2026-06-07

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bookit WordPress plugin versions prior to 2.5.1

Description The Bookit WordPress plugin contains a publicly accessible REST endpoint that allows unauthenticated modification of the plugin's Stripe payment settings. This allows attackers to alter the Stripe payment options without any authentication. The affected endpoint is a REST API. The vulnerable parameter is related to Stripe payment options.

Recommendations Update the Bookit WordPress plugin to version 2.5.1 or later.

Exploit

Fix

Related Identifiers

CVE-2025-12841

Affected Products

Bookit Wordpress Plugin

References · 5

• 🔥 https://wpscan.com/vulnerability/60cb3d5f-1aa5-4858-ab84-07fe7c023fdd · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-12841 · Security Note
• https://t.me/CVEtracker/39612 · Telegram Post
• https://t.me/cveNotify/145581 · Telegram Post
• https://twitter.com/pdnuclei_bot/status/2063605394451386826 · Twitter Post