Missing Authorization Exploit in BookPress Plugin by Black and White Digital
CVE-2025-25167

9.8CRITICAL

Key Information:

Vendor

WordPress
Status
Bookpress – For Book Authors
Vendor
CVE Published:
7 February 2025

What is CVE-2025-25167?

A critical security flaw has been identified in the BookPress – For Book Authors plugin developed by Black and White Digital. This missing authorization vulnerability allows for the exploitation of incorrectly configured access control mechanisms, potentially granting unauthorized users access to sensitive functionalities. The issue affects all versions leading up to 1.2.7, posing a significant risk to users who have not yet updated their installations.

Affected Version(s)

BookPress – For Book Authors <= 1.2.7

References

https://patchstack.com/database/wordpress/plugin/book-pre...
vdb-entry

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - Fore-Z co.ltd (Patchstack Alliance)
.