Unauthenticated Access in Bookit Plugin Leads to Payment Option Alterations
CVE-2025-12841
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2025-12841?
The Bookit plugin for WordPress, prior to version 2.5.1, contains a serious vulnerability due to a publicly accessible REST endpoint. This oversight allows unauthorized users to alter the Stripe payment options without authentication, posing significant risks to website security and potential financial fraud.
Affected Version(s)
Bookit 0 < 2.5.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.