EUVD-2025-21200Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a CRITICAL real-world risk despite mid-range CVSS scoring due to multiple compounding factors: (1) CVSS 8.8 reflects high impact (Confidentiality, Integrity, Availability all High) and low attack complexity (AC:L), indicating straightforward exploitation; (2) Attack Vector is Network (AV:N) with only Privilege level requirement (PR:L), making it exploitable by common user accounts; (3) Privilege escalation from Subscriber to RCE is severe; (4) No User Interaction required (UI:N) means automated exploitation is possible; (5) Scope is Unchanged, limiting lateral impact but RCE is already maximum severity. EPSS would likely be HIGH (>0.90) given the straightforward nature of file upload bypasses and prevalence of WordPress attacks. KEV status unknown from provided data, but this matches patterns of actively exploited WordPress plugin vulnerabilities. The combination of low attack complexity + authenticated access (extremely common on WordPress sites) + file upload (high-value target) + potential RCE makes this a priority vulnerability. This is NOT a low-real-risk-high-CVSS case; the signals align on genuine severity. |
| Exploit ScenarioDerived | A WordPress site using WPBookit 1.0.4 allows Subscriber-level user registration for booking purposes. An attacker registers as a Subscriber and navigates to the booking image upload feature. Instead of uploading a legitimate image file, the attacker crafts an HTTP POST request containing a PHP webshell (e.g., shell.php containing <?php system($_GET['cmd']); ?>) while falsifying the file extension to .jpg or MIME type to image/jpeg. The handle_image_upload() function, lacking proper validation, stores the PHP file in the plugin's upload directory (typically /wp-content/plugins/wpbookit/uploads/). The attacker then directly accesses the file at http://target.com/wp-content/plugins/wpbookit/uploads/shell.php?cmd=whoami, achieving remote code execution with web server privileges. From this point, the attacker can enumerate the database, create admin users, install persistent backdoors, or launch further attacks. No PoC code availability stated in provided intelligence, but this vulnerability class (arbitrary file upload to RCE) has well-documented public exploits in WordPress ecosystem. Attack execution time: <5 minutes for a skilled attacker with valid credentials. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 16, 2026
WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.
RemediationAI
Immediate Patch: Update WPBookit plugin to version 1.0.5 or later (when released) Workaround (if patch unavailable): Restrict file upload functionality and validate uploads Detection & Response: Identify compromised sites and clean malicious uploads
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the WPBookit plugin's image upload handler, which fails to properly validate file types before storage. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability. The root cause is insufficient input validation in the handle_image_upload() function, which likely accepts file uploads without checking MIME types, file extensions, or content signatures. WordPress plugins with subscriber-level access can typically interact with upload directories. An attacker can bypass client-side or weak server-side validation to upload PHP, JSP, or other executable files. The affected component processes HTTP POST requests for image uploads without adequate security controls. CPE would be: cpe:2.3:a:wpbookit:wpbookit:*:*:*:*:*:wordpress:*:* (versions <= 1.0.4).
Know when Wpbookit gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
Executive ViewAI
The WPBookit WordPress plugin contains a critical file upload vulnerability that allows any authenticated user (including low-privilege accounts) to upload and execute malicious code on your website. This directly threatens website integrity, data security, and business continuity, as attackers could compromise customer data, inject malware, or take complete control of affected systems.
Apply vendor patch. If immediate patching is not possible: (1) Restrict WPBookit plugin access to Administrator role only via user capability controls; (2) Implement WAF rules to block POST requests to handle_image_upload endpoints; (3) Disable the image upload feature entirely until patching is complete; (4) Monitor /wp-content/uploads directory for executable files (.php, .exe, .sh); (5) Consider temporary deactivation of the plugin if not critical to operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
The WPBookit WordPress plugin (versions ≤1.0.4) contains a critical arbitrary file upload vulnerability in the image_upl
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and
The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Iqonic Design WPBo
Stored Cross-Site Scripting in WPBookit WordPress plugin through version 1.0.1 can be achieved via CSRF attack vector. A
Missing Authorization vulnerability in Iqonic Design WPBookit allows Accessing Functionality Not Properly Constrained by
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient file type validation in th
The WPBookit plugin for WordPress is vulnerable to Arbitrary User Password Change in versions up to, and including, 1.6.
GitHub PoC
Exploit-DB