Wpbookit Pro CVE-2026-25414

Requires authenticated user access to WordPress site with WPBookit Pro plugin version 1.6.18 or earlier installed. Any logged-in WordPress user can exploit this privilege escalation vulnerability to gain administrative capabilities.

This vulnerability presents a significant real-world risk despite the absence of CVSS and EPSS data. The privilege escalation attack vector combined with the broad version range affected (all versions through 1.6.18) indicates systemic authorization flaws rather than isolated edge cases. The vulnerability is not listed as actively exploited in public KEV catalogs at this time, though privilege escalation flaws in widely-deployed WordPress plugins are attractive targets for automated scanning and exploitation. The Patchstack reporting suggests patch availability exists, indicating the vendor has acknowledged and remediated the issue. Without CVSS data, this should be treated as a high-priority fix given the nature of the vulnerability (privilege escalation), the scope of affected installations, and the likelihood that exploits will emerge once details become widely known. Organizations running WPBookit Pro should prioritize patching immediately.

An unauthenticated attacker or a low-privileged customer account holder could submit a specially crafted request to an unprotected administrative AJAX handler or REST API endpoint in WPBookit Pro, bypassing capability checks to perform actions such as creating administrator accounts, modifying booking prices, exporting customer data, or disabling security features. Because WordPress plugins often rely on implicit capability checks that can be bypassed with direct endpoint access, an attacker could systematically enumerate plugin endpoints and exploit missing or incorrect privilege validation to escalate from a basic user to full administrative control, granting them complete access to the WordPress site.