Bookify CVE-2025-69332

Exploitation requires the attacker to hold a valid authenticated WordPress session at subscriber level or above on the target site - the CVSS PR:L metric confirms this. No special server-side configuration of Bookify is stated as a prerequisite; any installation of the plugin at version ≤ 1.1.1 is assumed vulnerable. The primary limiting factor is the requirement for an authenticated account: sites with open user registration are at significantly higher risk because an attacker can self-register a subscriber account at no barrier. Sites with registration disabled limit exploitation to users who already possess valid credentials. The vulnerability results in confidentiality impact only (C:H, I:N, A:N), so attackers cannot modify data or cause service disruption via this vector alone.

The CVSS base score of 6.5 (Medium) is internally consistent: network-reachable, low complexity, low privilege, no user interaction, and high confidentiality impact with no integrity or availability loss. The PR:L metric confirms this is not an unauthenticated flaw - an attacker must hold at minimum a subscriber account on the target WordPress site, which materially limits opportunistic mass exploitation. No EPSS data was provided in the intelligence package; without it, probability of in-the-wild exploitation cannot be quantitatively assessed. No KEV listing and no confirmed public exploit code are present in the source data, so exploitation likelihood is currently speculative. For multi-tenant WordPress environments (shared hosting, membership sites, or sites with open user registration), the realistic risk is elevated because obtaining a subscriber account is trivial. For sites with registration disabled, the attack surface is limited to existing authenticated users.

An attacker registers a free subscriber account on a target WordPress site running Bookify ≤ 1.1.1 - or uses an existing low-privilege account. They then send a crafted authenticated HTTP request (e.g., a POST to an AJAX handler or REST endpoint) that invokes a privileged Bookify function, bypassing the missing authorization check and retrieving booking records, customer PII, or other confidential data. No public exploit code is confirmed at time of analysis, but the low attack complexity and standard WordPress exploitation patterns make this straightforward to reproduce from the vulnerability class alone.