CVE-2025-7852

CVE-2025-7852 : The WPBookit WordPress plugin is vulnerable to unauthenticated arbitrary file uploads due to missing file type validation in image_upload_handle(), exploited via the add_new_customer route. Affected versions are up to and including 1.0.6. The upload handler uses move_uploaded_file...