CSRF Vulnerability in WPBookit Plugin by WordPress
CVE-2025-12685
Key Information:
Badges
What is CVE-2025-12685?
The WPBookit plugin for WordPress, specifically version 1.0.7, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability. This issue arises due to the absence of a CSRF check when deleting customer accounts. As a result, an unauthenticated attacker could exploit this vulnerability to delete any customer without needing prior authentication. This highlights the importance of implementing robust security measures to safeguard user data and maintain the integrity of the plugin.
Affected Version(s)
WPBookit 0 <= 1.0.7
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved