Wpbookit EUVD-2025-21201

This vulnerability presents extreme real-world risk across multiple signal dimensions: (1) CVSS 9.8 with AV:N/AC:L/PR:N/UI:N confirms network accessibility, no authentication, no user interaction required, and universal impact (confidentiality, integrity, availability all HIGH); (2) CWE-434 is a well-known, frequently exploited class of vulnerability with established attack patterns; (3) The unauthenticated nature (PR:N) eliminates a critical barrier, making this exploitable by any internet-connected attacker; (4) File upload vulnerabilities are immediately automatable and highly reliable to exploit; (5) Remote code execution potential means technical impact is complete system compromise. The combination of zero barriers to exploitation, universal applicability, and RCE potential makes this a critical priority for any affected WordPress site. This is NOT a false alarm—high CVSS is justified here.

An attacker scans the internet for WordPress installations running WPBookit. Upon discovery, the attacker crafts a POST request to the 'add_booking_type' route with a PHP webshell file (e.g., shell.php) in the image upload parameter, bypassing client-side and server-side file type validation. The server accepts and stores the file in a web-accessible uploads directory. The attacker then navigates to the file's URL (e.g., http://target.com/wp-content/uploads/shell.php), triggering PHP execution. The attacker gains remote code execution, installs a backdoor, exfiltrates data, modifies site content, or pivots to internal networks. No authentication, social engineering, or user interaction is required; the entire attack is automatable and can be executed at scale against multiple targets simultaneously.