What is the CVSS score of CVE-2025-6057?

CVE-2025-6057 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of PHP are affected by CVE-2025-6057?

The WPBookit WordPress plugin contains a critical file upload vulnerability that allows any authenticated user (including low-privilege accounts) to upload and execute malicious code on your website.. A patch is available.

How to fix or mitigate CVE-2025-6057?

Within 24 hours: Identify all WordPress instances running WPBookit plugin and document current versions. Within 7 days: Update WPBookit to version 1.0.5 or later on all affected sites and verify successful deployment. Within 30 days: Conduct security audit of file upload directories, review access logs for suspicious uploads, and reset credentials for any accounts with Subscriber access or above as precautionary measure.

PHP CVE-2025-6057

EUVD-2025-21200 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-07-12 security@wordfence.com

PHP WordPress RCE Wpbookit Wordpress Plugin Iqonic

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 16, 2026 - 08:56 euvd

EUVD-2025-21200

Analysis Generated

Mar 16, 2026 - 08:56 vuln.today

Patch released

Mar 16, 2026 - 08:56 nvd

Patch available

CVE Published

Jul 12, 2025 - 05:15 nvd

HIGH 8.8

DescriptionCVE.org

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

AnalysisAI

WPBookit WordPress plugin versions up to 1.0.4 contain an arbitrary file upload vulnerability in the handle_image_upload() function due to missing file type validation, allowing authenticated attackers with Subscriber-level privileges to upload malicious files and potentially achieve remote code execution. This is a high-severity vulnerability (CVSS 8.8) affecting a plugin likely used by booking/appointment management websites, with low attack complexity and no user interaction required once authenticated.

Technical ContextAI

The vulnerability exists in the WPBookit plugin's image upload handler, which fails to properly validate file types before storage. This is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) vulnerability. The root cause is insufficient input validation in the handle_image_upload() function, which likely accepts file uploads without checking MIME types, file extensions, or content signatures. WordPress plugins with subscriber-level access can typically interact with upload directories. An attacker can bypass client-side or weak server-side validation to upload PHP, JSP, or other executable files. The affected component processes HTTP POST requests for image uploads without adequate security controls. CPE would be: cpe:2.3:a:wpbookit:wpbookit:*:*:*:*:*:wordpress:*:* (versions <= 1.0.4).

RemediationAI

Immediate Patch: Update WPBookit plugin to version 1.0.5 or later (when released) Workaround (if patch unavailable): Restrict file upload functionality and validate uploads Detection & Response: Identify compromised sites and clean malicious uploads