The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads because the image_upload_handle() function does not validate file type, MIME type or sanitise the filename before calling move_uploaded_file(). This allows an unauthenticated attacker to upload any file, including executable code, to the web server. The uploaded file could be accessed and executed, potentially giving the attacker full control over the site.

Any WordPress site that has the WPBookit plugin version 1.0.6 or earlier installed. The vulnerability exists in all releases up to and including 1.0.6 and affects sites that expose the add_new_customer route for the image upload handler.

The CVSS score of 9.8 indicates a critical severity, while the EPSS score of less than 1% shows the probability of exploitation is currently very low. The vulnerability is not listed in the CISA KEV catalog. However, the attack can be performed without authentication and is purely remote, so once a suitable payload is crafted an attacker could achieve remote code execution. Administrators should treat this as a high‑priority risk because of the potential impact.