Arbitrary File Upload Vulnerability in Alex Reservations Plugin for WordPress
CVE-2025-12399

7.2HIGH

Key Information:

Vendor

WordPress
Status
Alex Reservations: Smart Restaurant Booking
Vendor
CVE Published:
8 November 2025

What is CVE-2025-12399?

The Alex Reservations: Smart Restaurant Booking plugin for WordPress has a security flaw that allows authenticated users with Administrator-level access to upload arbitrary files through the insecure /wp-json/srr/v1/app/upload/file REST endpoint. This vulnerability stems from inadequate file type validation, potentially enabling an attacker to execute malicious code on the affected server, leading to severe security breaches.

Affected Version(s)

Alex Reservations: Smart Restaurant Booking 0 <= 2.2.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/alex-reservati...
https://github.com/d0n601/CVE-2025-12399

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ryan Kozak
.