CVE-2025-6057

Published
View on NVD ↗
CVSS v3
8.8
HIGH
CVSS v2
N/A
Affected
1
PROJECT

Description

The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

<p>Streamline your appointment booking process with WPBookit, the ultimate free appointment booking WordPress plugin. Ideal for businesses of all sizes, WPBookit offers a comprehensive suite of features designed to simplify scheduling, enhance user experience, and boost productivity.</p> <h3>Features:</h3> <ul> <li>Revenue Chart Report: Gain valuable insights into your earnings with detailed revenue charts.</li> <li>Booking Calendar/List View: View and manage bookings effortlessly with both calendar and list views.</li> <li>Different Calendars for Different Services: Organize your services with separate calendars for each one.</li> <li>Custom Time Slots: Customize available time slots to fit your unique business hours and needs.</li> <li>Calendar-wise Unavailable Dates: Mark unavailable dates on individual calendars to avoid scheduling conflicts.</li> <li>Guest Users List: Maintain a list of guest users for easy reference and follow-up.</li> <li>Easy Email Template Editing: Customize email templates with ease for a personalized communication experience.</li> <li>Translation Ready: Cater to a global audience with translation-ready capabilities.</li> </ul> <h3>Benefits:</h3> <ul> <li>Efficient Scheduling: Simplify the booking process with intuitive calendar and list views, ensuring smooth management of appointments.</li> <li>Enhanced User Experience: Provide a seamless experience for both customers and staff with features like custom timeslots, email notifications.</li> <li>Virtual Consultations: Offer convenient telemedicine services with Zoom integration, expanding your reach and flexibility.</li> <li>Comprehensive Management: Keep track of guest users, manage multiple services, and generate detailed reports to optimize your business operations.</li> <li>Global Reach: Serve a diverse audience with translation-ready functionality, making your services accessible to users worldwide.</li> </ul> <p>Elevate your appointment booking process with WPBookit &#8211; the free WordPress plugin designed to meet all your scheduling needs. <strong><a href="https://wpbookit.com" rel="nofollow ugc">WPBookit Pro</a> version is also available with advance featutes.</strong></p> <h3>Source Code</h3> <p>The original, non-minified source code for the JavaScript and CSS files used in this plugin can be found in the <code>core/admin/assets/src</code> directory of the plugin folder.</p> <h3>External Services</h3> <p>WPBookit interacts with external services to enhance functionality and provide accurate data.</p> <h3>Services Used:</h3> <ol> <li> <p><strong>ipapi.co</strong> (https://ipapi.co/)</p> <ul> <li><strong>Purpose</strong>: Used for geolocation purposes to automatically determine and set the user&#8217;s country based on their IP address.</li> <li><strong>Terms of Use</strong>: <a href="https://ipapi.co/terms/" rel="nofollow ugc">ipapi.co Terms of Service</a></li> <li><strong>Privacy Policy</strong>: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co Privacy Policy</a></li> </ul> </li> <li> <p><strong>Google Fonts</strong> (https://fonts.googleapis.com/)</p> <ul> <li><strong>Purpose</strong>: The plugin uses the &#8220;Plus Jakarta Sans&#8221; font, which is loaded from Google Fonts to enhance the visual appearance of the plugin.</li> <li><strong>Terms of Use</strong>: <a href="https://developers.google.com/fonts/terms" rel="nofollow ugc">Google Fonts Terms of Service</a></li> <li><strong>Privacy Policy</strong>: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google Fonts Privacy Policy</a></li> </ul> </li> <li> <p><strong>Add to Calendar Pro API</strong> (https://add-to-calendar-pro.com/)</p> <ul> <li><strong>Purpose</strong>: Used to add booking details directly to users&#8217; calendars.</li> <li><strong>Terms of Use</strong>: <a href="https://add-to-calendar-pro.com/terms/" rel="nofollow ugc">Add to Calendar Pro Terms of Service</a></li> <li><strong>Privacy Policy</strong>: <a href="https://add-to-calendar-pro.com/privacy-policy/" rel="nofollow ugc">Add to Calendar Pro Privacy Policy</a></li> </ul> </li> </ol> <p>By using WPBookit, you agree to the terms and conditions outlined by these external services.</p>
WordPress Plugin DirectoryWordPress Plugin Directory
4.13K