Unauthorized Data Modification in Booking Calendar Plugin for WordPress

CVE-2025-12633

What is CVE-2025-12633?

The Booking Calendar | Appointment Booking | Bookit plugin for WordPress has a critical flaw that allows for unauthorized data modification via a missing capability check on the '/wp-json/bookit/v1/commerce/stripe/return' REST API Endpoint. This vulnerability impacts all versions up to and including 2.5.0, allowing unauthenticated attackers to link their own Stripe accounts, consequently enabling them to receive payments, which can lead to severe financial fraud.

References