Arbitrary File Upload Vulnerability in WPBookit Plugin by WordPress

CVE-2025-6057

What is CVE-2025-6057?

The WPBookit plugin for WordPress has a serious vulnerability allowing authenticated users with Subscriber-level access and above to upload arbitrary files. This flaw arises from a lack of file type validation in the handle_image_upload() function. If exploited, it can lead to remote code execution on the affected site, compromising the integrity and security of the server. It is crucial for site administrators to promptly update their WPBookit installations to prevent potential exploits.

References