CVE-2025-12042
📋 TL;DR
The Course Booking System WordPress plugin allows unauthenticated attackers to directly access a CSV export file and download all booking data. This affects all WordPress sites using the plugin up to version 6.1.5. The vulnerability exists due to missing capability checks in the csv-export.php file.
💻 Affected Systems
- Course Booking System WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
All booking data (including potentially sensitive customer information) is exfiltrated by attackers, leading to data breach, privacy violations, and regulatory compliance issues.
Likely Case
Attackers download booking data containing names, email addresses, phone numbers, and course details, which could be used for phishing, spam, or identity theft.
If Mitigated
If proper access controls and web application firewalls are in place, unauthorized access attempts are blocked and logged.
🎯 Exploit Status
Exploitation requires only direct HTTP access to the vulnerable file path.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.1.6 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'Course Booking System' and click 'Update Now'. 4. Verify version is 6.1.6 or higher.
🔧 Temporary Workarounds
Block direct access to csv-export.php
linuxAdd .htaccess rule to block unauthenticated access to the vulnerable file
# Add to .htaccess in WordPress root directory
<Files "csv-export.php">
Order Allow,Deny
Deny from all
</Files>
Web Application Firewall rule
allBlock requests to /wp-content/plugins/course-booking-system/csv-export.php
🧯 If You Can't Patch
- Deactivate the Course Booking System plugin immediately
- Implement network-level blocking of requests to the vulnerable file path
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for Course Booking System version. If version is 6.1.5 or lower, you are vulnerable.Check Version:
wp plugin list --name='course-booking-system' --field=versionVerify Fix Applied:
After updating, verify plugin version shows 6.1.6 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- HTTP 200 responses to /wp-content/plugins/course-booking-system/csv-export.php from unauthenticated users
- Large CSV downloads from the plugin directory
Network Indicators:
- Unusual spikes in traffic to the csv-export.php endpoint
- CSV file downloads from unexpected IP addresses
SIEM Query:
source="web_server_logs" AND uri="/wp-content/plugins/course-booking-system/csv-export.php" AND response_code=200 AND NOT user_agent="WordPress/*"