An unrestricted file upload vulnerability exists in the WPBookit Pro plugin up to version 1.6.18. The plugin fails to validate the MIME type of uploaded files, enabling an attacker to upload a file of a dangerous type such as a PHP script. If the uploaded script is executed, it can lead to remote code execution and compromise the entire WordPress site.

The flaw is present in the WPBookit Pro plugin developed by IQonic Design. It affects all installations of the plugin from the initial release through version 1.6.18. Site administrators should verify whether they are running a vulnerable version and consider upgrading.

The vulnerability has a CVSS score of 9.9, indicating a high severity impact due to potential remote code execution. The EPSS score is less than 1 %, suggesting that widespread exploitation is unlikely, and the issue is not listed in the CISA KEV catalog. The likely attack vector involves the web interface of the plugin, where any authenticated user with upload privileges could introduce a malicious file. Successful execution of such a file would grant an attacker full control over the web server.