CVE-2025-7852

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-7852", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-18T22:04:48.835Z", "datePublished": "2025-07-24T04:24:12.852Z", "dateUpdated": "2026-04-08T16:34:54.943Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:54.943Z"}, "affected": [{"vendor": "iqonicdesign", "product": "WPBookit", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin\u2019s image\u2010upload handler calls move_uploaded_file() on client\u2010supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "title": "WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php#L362"}, {"url": "https://wordpress.org/plugins/wpbookit/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3331165/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type", "cweId": "CWE-434", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "timeline": [{"time": "2025-07-18T22:20:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-07-23T16:22:34.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-24T13:12:10.139673Z", "id": "CVE-2025-7852", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:36:47.798Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-7852", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-07-24T13:12:10.139673Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-24T13:14:49.183Z"}}], "cna": {"title": "WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function", "credits": [{"lang": "en", "type": "finder", "value": "Youcef Hamdani"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "iqonicdesign", "product": "WPBookit", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-18T22:20:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-07-23T16:22:34.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php#L362"}, {"url": "https://wordpress.org/plugins/wpbookit/#developers"}, {"url": "https://plugins.trac.wordpress.org/changeset/3331165/"}], "descriptions": [{"lang": "en", "value": "The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin\u2019s image\u2010upload handler calls move_uploaded_file() on client\u2010supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-434", "description": "CWE-434 Unrestricted Upload of File with Dangerous Type"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:34:54.943Z"}}}, "cveMetadata": {"cveId": "CVE-2025-7852", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:34:54.943Z", "dateReserved": "2025-07-18T22:04:48.835Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-24T04:24:12.852Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WPBookit", "vendor": "iqonicdesign", "versions": [{"lessThanOrEqual": "1.0.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin\u2019s image\u2010upload handler calls move_uploaded_file() on client\u2010supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible."}, {"lang": "es", "value": "El complemento WPBookit para WordPress es vulnerable a la carga de archivos arbitrarios debido a la falta de validaci\u00f3n del tipo de archivo en la funci\u00f3n image_upload_handle(), conectada mediante la ruta 'add_new_customer' en todas las versiones hasta la 1.0.6 incluida. El controlador de carga de im\u00e1genes del complemento llama a move_uploaded_file() en los archivos proporcionados por el cliente sin restringir las extensiones ni los tipos MIME permitidos, ni depurar el nombre del archivo. Esto permite que atacantes no autenticados carguen archivos arbitrarios en el servidor del sitio afectado, lo que podr\u00eda posibilitar la ejecuci\u00f3n remota de c\u00f3digo."}], "id": "CVE-2025-7852", "lastModified": "2026-06-17T10:05:47.520", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-7852", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-07-24T13:12:10.139673Z", "version": "2.0.3"}}]}, "published": "2025-07-24T07:15:55.013", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/controllers/class.wpb-customer-controller.php#L362"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3331165/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/wpbookit/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/0bb11092-4367-4f51-9dd7-22fbd655a03f?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-434"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T17:03:37.205041+00:00", "value": {"mitigation_remediation": ["Monitor the plugin repository and apply any released fix as soon as it becomes available.", "If no fix is available, temporarily disable the WPBookit plugin to stop further arbitrary uploads.", "Configure the web server or add a .htaccess rule to prevent execution of files in the upload directory (e.g., set the directory to non\u2011executable or disable PHP execution)."], "summary": {"action": "Assess Impact", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "Any WordPress site that has the WPBookit plugin version 1.0.6 or earlier installed. The vulnerability exists in all releases up to and including 1.0.6 and affects sites that expose the add_new_customer route for the image upload handler.", "description_and_impact": "The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads because the image_upload_handle() function does not validate file type, MIME type or sanitise the filename before calling move_uploaded_file(). This allows an unauthenticated attacker to upload any file, including executable code, to the web server. The uploaded file could be accessed and executed, potentially giving the attacker full control over the site.", "risk_and_exploitability": "The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% shows the probability of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. However, the attack can be performed without authentication and is purely remote, so once a suitable payload is crafted an attacker could achieve remote code execution. Administrators should treat this as a high\u2011priority risk because of the potential impact."}}}}, "created": "2025-07-24T21:26:43.870980+00:00", "updated": "2026-04-22T17:15:22.192712+00:00", "vendors": ["iqonicdesign", "iqonicdesign$PRODUCT$wpbookit", "wordpress", "wordpress$PRODUCT$wordpress"]}