Privilege Escalation Vulnerability in WPBookit Plugin for WordPress
CVE-2025-3810
9.8CRITICAL
What is CVE-2025-3810?
The WPBookit plugin for WordPress introduces a significant security risk due to its insufficient validation of user identities when updating user details, such as passwords and email addresses. This weakness enables unauthenticated attackers to manipulate the profiles of all users, including those with administrative privileges. By exploiting the flaw within the edit_profile_data() function, malicious actors can gain unauthorized access to user accounts, posing a serious threat to the integrity and security of the WordPress site.
Affected Version(s)
WPBookit * <= 1.0.2
References
CVSS V3.1
Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Kenneth Dunn