CVE-2025-6058 – The WPBookit WordPress plugin allows unauthenti... (How to Fix)

Q: What is the severity of CVE-2025-6058?

CVE-2025-6058 has a CVSS score of 9.8 (CRITICAL). The WPBookit WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This vulnerability can lead to remote code execution on affected websites. All WordPress sites using WPBookit version 1.0.4 or earlier are vulnerable.

📋 TL;DR

The WPBookit WordPress plugin allows unauthenticated attackers to upload arbitrary files due to missing file type validation. This vulnerability can lead to remote code execution on affected websites. All WordPress sites using WPBookit version 1.0.4 or earlier are vulnerable.

💻 Affected Systems

Products:

WPBookit WordPress Plugin

Versions: All versions up to and including 1.0.4

Operating Systems: Any OS running WordPress

Default Config Vulnerable: ⚠️ Yes

Notes: Requires the plugin to be installed and active. No special configuration needed for exploitation.

📦 What is this software?

Wpbookit by Iqonic

View all CVEs affecting Wpbookit →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete server compromise via remote code execution, allowing attackers to install backdoors, steal data, deface websites, or use the server for malicious activities.

🟠

Likely Case

Attackers upload web shells to gain persistent access, install malware, or use the server as part of a botnet.

🟢

If Mitigated

File uploads are blocked or properly validated, preventing malicious file execution while maintaining plugin functionality.

🌐 Internet-Facing: HIGH - WordPress sites are typically internet-facing, and unauthenticated exploitation makes this easily accessible to attackers.

🏢 Internal Only: MEDIUM - Internal WordPress installations could still be targeted via phishing or compromised internal accounts.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Simple file upload vulnerability with no authentication required. Attackers can easily craft malicious file uploads.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 1.0.5 or later

Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3314288%40wpbookit&new=3314288%40wpbookit&sfp_email=&sfph_mail=

Restart Required: No

Instructions:

1. Log into WordPress admin panel. 2. Go to Plugins → Installed Plugins. 3. Find WPBookit and click 'Update Now'. 4. Verify version is 1.0.5 or higher.

🔧 Temporary Workarounds

Disable WPBookit Plugin

all

Temporarily disable the vulnerable plugin until patched

wp plugin deactivate wpbookit

Restrict File Uploads via .htaccess

linux

Block PHP and other executable file uploads to the uploads directory

Add to .htaccess in wp-content/uploads: <FilesMatch "\.(php|php5|php7|phtml|phar)$">
    Order Allow,Deny
    Deny from all
</FilesMatch>

🧯 If You Can't Patch

Disable the WPBookit plugin immediately
Implement web application firewall rules to block file uploads to the vulnerable endpoint

🔍 How to Verify

Check if Vulnerable:

Check WordPress admin → Plugins → Installed Plugins for WPBookit version 1.0.4 or earlier

Check Version:

wp plugin get wpbookit --field=version

Verify Fix Applied:

Verify WPBookit version is 1.0.5 or higher in WordPress admin

📡 Detection & Monitoring

Log Indicators:

Unusual POST requests to /wp-admin/admin-ajax.php with action=add_booking_type
File uploads with non-image extensions to uploads directory
New PHP files in wp-content/uploads with suspicious names

Network Indicators:

POST requests to admin-ajax.php with file uploads from unauthenticated sources
Traffic to newly created PHP files in uploads directory

SIEM Query:

source="web_server" AND (uri="/wp-admin/admin-ajax.php" AND method="POST" AND params.action="add_booking_type") OR (uri CONTAINS "/wp-content/uploads/" AND uri ENDS WITH ".php")

📊 Metadata

CVE ID: CVE-2025-6058

CVSS v3 Score: 9.8 (CRITICAL)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-434

EPSS Score: 22.76% exploit probability (95.7th percentile)

Published: July 12, 2025

Last Updated: July 16, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-6058, you might also want to check these: