The BookingPress Pro plugin for WordPress contains a flaw that allows unauthenticated attackers to upload arbitrary files by omitting file type validation when a signature custom field is present in the booking form. This vulnerability can lead to remote code execution if an attacker places malicious payloads such as PHP scripts on the server, thereby compromising site integrity and confidentiality.

Vendors affected are Repute Infosystems. The vulnerable product is BookingPress appointment booking pro, with all releases up to and including version 5.6 susceptible to this issue. Any instances of BookingPress Pro on WordPress sites that have not yet updated beyond 5.6 are at risk.

The CVSS score is 9.8, indicating a critical flaw. EPSS is not available, but the absence of KEV listing does not reduce danger; the flaw remains exploitable by unauthenticated users who can submit a crafted booking form. An attacker can achieve remote code execution by uploading a web‑shell or malicious script, and the vulnerability requires only the presence of a signature custom field, which is a common configuration. Thus, immediate patching or mitigation is essential.