CVE-2026-25439: WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulnerability
Unauthenticated Broken Authentication in Booknetic <= 4.8.5 versions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
Booknetic (WordPress plugin)from your environment.Uninstall the Booknetic plugin if it is not required or cannot be immediately secured.
- Configuration
Deactivate the Booknetic plugin until a security patch is available or the issue is otherwise remediated.
WordPress Booknetic plugin active = false - Compensating control
Restrict access to WordPress admin and Booknetic plugin endpoints to trusted IP addresses or place them behind a web application firewall (WAF) to block unauthenticated access.
- Operational
Rotate credentials for administrative and user accounts that may have been impacted by the account takeover vulnerability and force password resets where appropriate.
- Operational
Review logs and audit recent account activity for signs of unauthorized access or account takeover related to the Booknetic plugin.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25439?
The severity of CVE-2026-25439 is rated as high with a score of 8.1.
How do I fix CVE-2026-25439?
To fix CVE-2026-25439, update the Booknetic plugin to version 4.8.6 or higher.
What type of vulnerability is CVE-2026-25439?
CVE-2026-25439 is categorized as an unauthenticated broken authentication vulnerability.
What versions of Booknetic are affected by CVE-2026-25439?
CVE-2026-25439 affects the Booknetic plugin versions up to and including 4.8.5.
What risks does CVE-2026-25439 pose to WordPress sites?
CVE-2026-25439 poses a risk of account takeover, allowing attackers to gain unauthorized access to user accounts.