The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This vulnerability allows authenticated attackers with Subscriber-level access and above to upload arbitrary files on the affected site’s server, potentially leading to remote code execution.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-6057 |
Exploitation
To exploit this vulnerability, an attacker with Subscriber-level access can upload malicious files to the server by bypassing the file type validation in the handle_image_upload() function. This could lead to the execution of arbitrary code on the server, compromising the integrity and confidentiality of the affected site.
Affected Products
- WPBookit Plugin: A WordPress plugin that allows users to manage bookings and appointments, which is vulnerable to file upload attacks.
Mitigation
To mitigate this vulnerability, it is recommended to update the WPBookit plugin to the latest version where the file type validation issue has been addressed. Additionally, implementing strict file upload controls and monitoring for unauthorized file uploads can help enhance security.