CVE-2025-6814

CVE-2025-6814 affects Booking X for WordPress (versions 1.0–1.1.2). The root cause is a missing capability check in export_now(), allowing unauthenticated attackers to download all plugin data (including user accounts, user meta, and PayPal credentials) via a crafted POST request. Public details ...