CVE-2025-7852

CVE-2025-7852 is a critical unauthenticated arbitrary file upload in the WPBookit WordPress plugin, affecting all versions up to and including 1.0.6 . The root cause is missing file type validation in the image_upload_handle() function, hooked via the 'add_new_customer' route. The handler calls m...