The WPBookit plugin, a WordPress booking tool, contains a flaw in its handle_image_upload() function that fails to validate uploaded file types. The missing validation allows an authenticated user with Subscriber-level access or higher to upload any file to the server. This flaw can enable attackers to place malicious code on the site, potentially leading to remote code execution or other destructive consequences.

All installations of WPBookit up to and including version 1.0.4 are affected. The plugin is provided by iqonicdesign and is a free WordPress plugin. The vulnerability applies to any WordPress site with the plugin installed and with users who have Subscriber or higher permissions.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is <1%, implying a low likelihood of current exploitation. It is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. Attackers would need access to a user account with Subscriber or higher permissions and the ability to reach the plugin’s upload endpoint. Once the upload path is exploited, the attacker can place a script that the server may execute, turning the site into a potential drop point for further attacks.