CVE-2025-12841
📋 TL;DR
The Bookit WordPress plugin before version 2.5.1 has an unauthenticated REST API endpoint that allows attackers to modify Stripe payment settings. This affects all WordPress sites running vulnerable versions of the Bookit plugin. Attackers could redirect payments or disrupt payment processing.
💻 Affected Systems
- Bookit WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers redirect all Stripe payments to their own account, stealing revenue from the business.
Likely Case
Attackers disrupt payment processing by modifying Stripe keys, causing transaction failures and business disruption.
If Mitigated
No impact if the vulnerable endpoint is properly secured or the plugin is updated.
🎯 Exploit Status
Simple HTTP POST request to the vulnerable REST endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.1
Vendor Advisory: https://wpscan.com/vulnerability/60cb3d5f-1aa5-4858-ab84-07fe7c023fdd/
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Bookit plugin and click 'Update Now'. 4. Verify version shows 2.5.1 or higher.
🔧 Temporary Workarounds
Disable Bookit Plugin
linuxTemporarily disable the vulnerable plugin until patched.
wp plugin deactivate bookit
Block REST Endpoint via .htaccess
linuxBlock access to the vulnerable REST API endpoint.
RewriteEngine On
RewriteRule ^wp-json/bookit/v1/stripe-settings - [F,L]
🧯 If You Can't Patch
- Disable the Bookit plugin immediately.
- Implement WAF rules to block requests to /wp-json/bookit/v1/stripe-settings.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Bookit version. If version is below 2.5.1, system is vulnerable.Check Version:
wp plugin list --name=bookit --field=versionVerify Fix Applied:
Confirm Bookit plugin version shows 2.5.1 or higher in WordPress admin.📡 Detection & Monitoring
Log Indicators:
- POST requests to /wp-json/bookit/v1/stripe-settings from unauthenticated users
- Unusual modifications to Stripe configuration
Network Indicators:
- HTTP POST to /wp-json/bookit/v1/stripe-settings without authentication headers
SIEM Query:
source="web_logs" AND uri_path="/wp-json/bookit/v1/stripe-settings" AND http_method="POST" AND NOT user_agent="WordPress/*"