CVE-2025-7852criticalobserved exploitationCWE-434

CVE-2025-7852: critical vulnerability in iqonicdesign WPBookit

WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function

Published · Updated

Follow this CVE+ Monitor WPBookit

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

50Vexday Risk Score

Prioritize patching. It exploitation observed by VulnCheck.

ssvc Actcvss 9.8epss 1.6%
from disclosure to weapon
Published on NVDJul 24
VulnCheck+350d
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
iqonicdesign · WPBookit
Related CVEs — iqonicdesign WPBookit

In the same product, most dangerous first.

CVE-2025-6058CRITICALWPBookit <= 1.0.4 - Unauthenticated Arbitrary File UploadEPSS 6.2%CVE-2026-1980MEDIUMWPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data ExposureEPSS 0.9%CVE-2025-6057HIGHWPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File UploadEPSS 0.8%CVE-2025-3811CRITICALWPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email UpdateEPSS 0.8%CVE-2025-3810CRITICALWPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account TakeoverEPSS 0.8%CVE-2026-1945HIGHWPBookit <= 1.0.8 - Unauthenticated Stored Cross-Site Scripting via 'wpb_user_name' and 'wpb_user_email' ParametersEPSS 0.4%