GCVE - cpe:2.3:a:iqonic:wpbookit:*:*:*:*:free:wordpress:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:iqonic:wpbookit:*:*:*:*:free:wordpress:*:*

part: a version: * update: *

Vendor	Iqonic (`ca08c7c3-1baf-5f62-ad11-41c5e5166999`)
Product	Wpbookit (`789e8f9e-55ec-590b-ad12-1728cfac1356`)
Edition	*
Language	*
Software edition	free
Target software	wordpress
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2025-6058`	vulnerable	2026-06-08 07:43:14.196955	WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload CRITICAL (9.8) The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_booking_type' route in all versions up to, and including, 1.0.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. Published: 2025-07-12T04:22:21.429Z Updated: 2026-04-08T16:40:36.449Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/1d779ad1-fdbe-444c-85c5-99146a1a03d8?source=cve https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-booking-type-controller.php#L455 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314288%40wpbookit&new=3314288%40wpbookit&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-6057`	vulnerable	2026-06-08 07:43:14.196450	WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload HIGH (8.8) The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible. Published: 2025-07-12T04:22:22.035Z Updated: 2026-04-08T17:34:26.107Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/fac81cc0-c6c9-4009-aacb-52adc70c0261?source=cve https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php#L85 https://wordpress.org/plugins/wpbookit/ https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3326098%40wpbookit&new=3326098%40wpbookit&sfp_email=&sfph_mail=	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3811`	vulnerable	2026-06-08 07:23:09.935033	WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update CRITICAL (9.8) The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like email through the edit_newdata_customer_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses, including administrators, and leverage that to reset the user's password and gain access to their account. Published: 2025-05-09T01:42:35.183Z Updated: 2026-04-08T17:13:25.332Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/a61cce43-0df7-4ca9-8897-24c7d131b505?source=cve https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-3810`	vulnerable	2026-06-08 07:23:09.934549	WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover CRITICAL (9.8) The WPBookit plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.0.2. This is due to the plugin not properly validating a user's identity prior to updating their details like password and email through the edit_profile_data() function. This makes it possible for unauthenticated attackers to change arbitrary user's email addresses and passwords, including administrators, and leverage that to gain access to their account. Published: 2025-05-09T01:42:34.585Z Updated: 2026-04-08T16:53:25.522Z Open on db.gcve.eu Reference links https://www.wordfence.com/threat-intel/vulnerabilities/id/54f1ebfb-67f1-461d-91f1-269b0a2c0653?source=cve https://plugins.trac.wordpress.org/changeset/3278939/wpbookit/trunk/core/admin/classes/controllers/class.wpb-profile-controller.php	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-32254`	vulnerable	2026-06-08 07:18:59.375556	WordPress WPBookit plugin <= 1.0.7 - Broken Access Control vulnerability MEDIUM (5.3) Missing Authorization vulnerability in Iqonic Design WPBookit wpbookit allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WPBookit: from n/a through <= 1.0.7. Published: 2025-04-04T15:59:28.387Z Updated: 2026-04-28T16:12:19.925Z Open on db.gcve.eu Reference links https://patchstack.com/database/Wordpress/Plugin/wpbookit/vulnerability/wordpress-wpbookit-plugin-1-0-1-broken-access-control-vulnerability?_s_id=cve	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2025-26910`	vulnerable	2026-06-08 07:14:50.659584	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.