Wpbookit Pro EUVD-2026-15720

Authenticated user with low-privilege access to WordPress site running WPBookit Pro plugin version ≤1.6.18. Attacker uploads malicious file through plugin's upload functionality without victim interaction required.

This vulnerability presents a critical real-world risk despite the absence of a CVSS score and EPSS data in the provided intelligence. The attack vector is network-based with no authentication required, making it highly accessible to unauthenticated threat actors. CWE-434 vulnerabilities are consistently exploitable and have a clear technical impact (remote code execution). The vulnerability affects an active WordPress plugin with a defined affected version range (up to 1.6.18), and the Patchstack reporting suggests this is a known, documented issue. Given that file upload vulnerabilities are frequently the target of automated scanners and mass exploitation campaigns, this should be treated as a high-priority vulnerability regardless of missing CVSS metrics. The fact that Patchstack has catalogued it with a specific EUVD ID (EUVD-2026-15720) further validates its legitimacy and exploitation likelihood.

An unauthenticated attacker discovers a WPBookit Pro installation running version 1.6.18 or earlier through WordPress plugin enumeration or Shodan/similar scanning. The attacker crafts a malicious PHP webshell, bypasses the plugin's insufficient file type validation by uploading it with a spoofed extension or by exploiting a null-byte injection, and accesses the uploaded file via direct HTTP request to execute arbitrary code. Within minutes, the attacker gains persistent web shell access, enumerates database credentials from wp-config.php, exfiltrates customer booking data, or deploys ransomware across the compromised WordPress installation and associated server infrastructure. No special privileges or interaction are required from the site administrator.