CVE-2025-7852: WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle() function hooked via the 'addnewcustomer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls moveuploadedfile() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress WPBookit pluginto a version that resolves this vulnerability.Fixed in 1.0.6 - Compensating control
Apply compensating controls until the plugin is patched: restrict access to the WordPress upload directory (where uploaded files are stored) so uploaded files cannot be executed as server-side code.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-7852?
CVE-2025-7852 is classified as a high severity vulnerability due to the risk of arbitrary file uploads.
How do I fix CVE-2025-7852?
To mitigate CVE-2025-7852, update the WPBookit plugin to version 1.0.7 or later.
What versions of WPBookit are affected by CVE-2025-7852?
CVE-2025-7852 affects all versions of the WPBookit plugin up to and including version 1.0.6.
What is the main issue with CVE-2025-7852?
CVE-2025-7852 allows arbitrary file uploads due to insufficient file type validation in the image upload handler.
Is there a workaround for CVE-2025-7852 if I cannot update WPBookit?
A possible workaround for CVE-2025-7852 is to disable the WPBookit plugin until it can be updated to a patched version.