EUVD-2026-31367
GHSA-qf4r-cjjc-2864
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress sites running BookingPress Pro ≤5.6
-
DeliveryLocate booking form containing signature field
-
ExploitSubmit crafted multipart request uploading PHP payload
-
ExecutionBypass missing file-type validation in bookingpress_validate_submitted_booking_form_func
-
PersistRequest uploaded webshell URL to execute code
-
ImpactRead wp-config.php and pivot to database/host
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target site must run BookingPress Pro at version ≤5.6 AND a site administrator must have added a 'signature' custom field to at least one booking form - without that field the vulnerable code path in bookingpress_validate_submitted_booking_form_func is not reached. Given those conditions, exploitation is remote, unauthenticated (PR:N), requires no user interaction (UI:N), and works against the default WordPress upload-handling configuration. There are no platform restrictions beyond a standard PHP-capable WordPress hosting environment, and successful PHP execution additionally depends on the web server being configured to execute scripts from the wp-content uploads tree (the WordPress default). |
| Impact | The CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N with C:H/I:H/A:H scoring 9.8 reflects pre-auth network exploitation yielding full server compromise, which is realistic for a file-upload-to-RCE chain on WordPress. The notable mitigating factor is configuration-dependence: exploitation only works if a site administrator has added a signature custom field to the booking form, so the installed-base exposure is narrower than raw CVSS implies. EPSS data was not supplied and CISA KEV does not list this CVE, so there is no confirmed active exploitation; however, Wordfence-disclosed WordPress file-upload bugs are routinely scanned for at scale within days of publication. No POC URL is included in the references, so 'no public exploit identified at time of analysis' applies - but defenders should not treat that as durable. |
| Exploit ScenarioDerived | An attacker enumerates WordPress sites running BookingPress Pro ≤5.6 with a signature field on the booking form, submits a crafted multipart booking-form POST that places a PHP webshell into the signature upload, then requests the resulting URL under wp-content to execute arbitrary code as the web server user. From there the attacker pivots to database credentials in wp-config.php and establishes persistence. No public POC is referenced, but the disclosure detail and the well-trodden CWE-434 pattern make construction of a working exploit straightforward for a competent attacker. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 21, 2026
Unauthenticated arbitrary file upload in the BookingPress Pro WordPress plugin (versions ≤5.6) enables remote code execution by abusing missing file type validation in the bookingpress_validate_submitted_booking_form_func function. Exploitation requires the booking form to include a signature custom field, but otherwise needs no authentication or user interaction. No public exploit identified at time of analysis, though Wordfence's disclosure and the CWE-434 pattern make weaponization straightforward.
RemediationAI
Patch available per vendor advisory - upgrade BookingPress Pro to a release later than 5.6 as published by Repute Infosystems on https://www.bookingpressplugin.com/ and tracked at the Wordfence advisory https://www.wordfence.com/threat-intel/vulnerabilities/id/ed738dc5-7848-4b04-a3fd-317cc366acfa?source=cve; an exact fixed version is not independently confirmed from the supplied data, so verify the changelog before deploying. If immediate patching is not possible, remove any signature custom field from booking forms in the BookingPress admin UI (this directly removes the upload code path the bug depends on, at the cost of losing signature collection on bookings), and as a defense-in-depth measure deny execution of PHP files inside the BookingPress uploads directory via web server rules (e.g., a location block or .htaccess denying .php) - this can break legitimate plugin functionality if it writes server-executed scripts, so test in staging. A WAF with WordPress file-upload signatures (Wordfence, Patchstack) should be enabled in blocking mode until the patch is applied.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
BookingPress Pro is a commercial appointment-booking plugin for WordPress developed by Repute Infosystems (CPE: cpe:2.3:a:repute_infosystems:bookingpress_appointment_booking_pro). The flaw is a classic CWE-434 (Unrestricted Upload of File with Dangerous Type) issue: the form-submission handler bookingpress_validate_submitted_booking_form_func accepts files attached to a signature custom field without checking MIME type, extension, or content. WordPress plugins that write uploads beneath wp-content typically deposit them under the web root, so a PHP payload uploaded through the booking form is directly fetchable and executable by the PHP-FPM/Apache process running WordPress.
Know when Bookingpress Appointment Booking Pro gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The BookingPress Pro plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'bookingpress_validate_submitted_booking_form_func' function in all versions up to, and including, 5.6. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Note: The vulnerability can only be exploited if a signature custom field is added to the booking form.
Executive ViewAI
BookingPress Pro WordPress plugin versions 5.6 and earlier allow unauthenticated remote attackers to execute arbitrary code on affected websites. Organizations using this plugin face immediate risk of website defacement, customer data theft, credential compromise, and business continuity disruption.
No vendor-released patch identified at time of analysis. Interim mitigations if plugin removal is not immediately feasible: Deactivate plugin and restrict form access via firewall rules; implement web application firewall rules to block file uploads via booking form endpoints; disable PHP execution in wp-content/uploads/ directory; deploy file integrity monitoring on upload directories; implement comprehensive logging and alerting on suspicious file operations and PHP execution outside designated directories.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
BookingPress Appointment Booking Pro WordPress plugin before version 5.7.3 exposes all REST API routes in a specific nam
SQL injection in Repute Infosystems' BookingPress Appointment Booking Pro plugin for WordPress (versions <= 6.0.2) lets
SQL injection in the BookingPress Appointment Booking Pro WordPress plugin (versions up to and including 5.7.1) allows u
Exploit-DB