The WPBookit plugin for WordPress suffers from insufficient file type validation in its profile image upload routine, which permits an unauthenticated attacker to submit any file to the server. This flaw qualifies as a CWE‑434, providing a pathway for arbitrary code execution if a malicious script is uploaded. The official CVSS score of 9.8 indicates a critical level of severity, while the low EPSS score of less than 1 percent suggests that widespread exploitation is currently unlikely but the potential damage is severe.

Versions of WPBookit up to and including 1.6.9, distributed by Iqonic Design, are affected. The vulnerability exists in the plugin’s handling of image uploads within the WordPress installation where the plugin is active.

Despite the low prevalence indicated by the EPSS metric, the high impact score makes this a priority concern. The attack vector is inferred to involve unauthenticated HTTP requests to the upload interface; a successful upload could enable remote code execution on the host. As the vulnerability is not listed in CISA’s KEV catalog, no public exploit has been observed, but the lack of mitigation on many sites leaves them open to potential future attacks.