CVE-2025-7852

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function hooked via the 'addnewcustomer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls moveuploadedfile on...

CVE-2025-7852 WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function hooked via the 'addnewcustomer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls moveuploadedfile on...

CVE-2025-7852 WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the imageuploadhandle function hooked via the 'addnewcustomer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls moveuploadedfile on...

CVE-2025-7852

CVE-2025-7852 is a critical unauthenticated arbitrary file upload in the WPBookit WordPress plugin, affecting all versions up to and including 1.0.6 . The root cause is missing file type validation in the image_upload_handle() function, hooked via the 'add_new_customer' route. The handler calls m...

WordPress WPBookit plugin <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function vulnerability

Unauthenticated Arbitrary File Upload via imageuploadhandle Function vulnerability discovered by theviper17y in WordPress Plugin WPBookit versions = 1.0.6...