CVE-2025-12633

CVE-2025-12633 : The Booking Calendar | Appointment Booking | Bookit plugin for WordPress is vulnerable due to a missing capability check on the REST endpoint /wp-json/bookit/v1/commerce/stripe/return, affecting all versions up to and including 2.5.0. This allows unauthenticated attackers to conn...