CVE-2025-25167
📋 TL;DR
This CVE describes a missing authorization vulnerability in the BookPress WordPress plugin that allows attackers to bypass access controls. Attackers could potentially modify book content, settings, or user data without proper permissions. All WordPress sites running BookPress versions up to 1.2.7 are affected.
💻 Affected Systems
- BookPress – For Book Authors WordPress plugin
📦 What is this software?
Bookpress by Blackandwhitedigital
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attackers could modify or delete book content, change plugin settings, or potentially escalate privileges to compromise the entire WordPress site.
Likely Case
Authenticated users with limited permissions could perform actions reserved for administrators, such as modifying book content or changing plugin configurations.
If Mitigated
With proper access controls and authentication checks, only authorized administrators could perform administrative actions on book content.
🎯 Exploit Status
Exploitation requires understanding of WordPress plugin structure and access control mechanisms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 1.2.7
Restart Required: No
Instructions:
1. Log into WordPress admin panel
2. Navigate to Plugins → Installed Plugins
3. Find BookPress – For Book Authors
4. Click 'Update Now' if available
5. If no update available, deactivate and delete the plugin
6. Install latest version from WordPress repository
🔧 Temporary Workarounds
Disable BookPress Plugin
WordPressTemporarily deactivate the vulnerable plugin until patched version is available
wp plugin deactivate book-press
🧯 If You Can't Patch
- Implement strict network access controls to limit who can access the WordPress admin interface
- Enable WordPress security plugins that add additional access control layers and monitor for unauthorized actions
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → BookPress – For Book Authors version numberCheck Version:
wp plugin get book-press --field=versionVerify Fix Applied:
Verify plugin version is 1.2.8 or higher, or plugin is deactivated/removed📡 Detection & Monitoring
Log Indicators:
- Unauthorized POST requests to BookPress admin endpoints
- Multiple failed authorization attempts on book-related endpoints
- Unexpected modifications to book content or settings
Network Indicators:
- Unusual traffic patterns to /wp-admin/admin-ajax.php with bookpress parameters
- Requests to bookpress endpoints from unauthorized IP addresses
SIEM Query:
source="wordpress.log" AND ("bookpress" OR "book-press") AND ("admin" OR "ajax") AND status=200 AND user_role!="administrator"