The WPBookit plugin, a WordPress booking tool, contains a flaw in its handle_image_upload() function that fails to validate uploaded file types. The missing validation allows an authenticated user with Subscriber-level access or higher to upload any file to the server. This flaw can enable attackers to place malicious code on the site, potentially leading to remote code execution or other destructive consequences.

All installations of WPBookit version 1.0.4 or earlier are affected. The plugin is distributed by iqonicdesign:WPBookit, and the cpe shows it is a free WordPress plugin. The vulnerability applies to any WordPress site that has the plugin installed and has users with Subscriber or higher permissions.

The vulnerability carries a CVSS score of 8.8, indicating high severity, while the EPSS score is less than 1%, implying a low likelihood of current exploitation. It is not listed in the CISA KEV catalog, which suggests no known widespread exploitation yet. Attackers would need authenticated subscriber credentials, which are often short‑lived or shared, and the ability to navigate to the plugin’s upload endpoint. Once the upload path is exploited, the attacker can place a script that the server may execute, turning the site into a potential drop point for further attacks.