CVE-2025-6057
Published
CVSS v3
8.8
HIGH
CVSS v2
N/A
Affected
1
PROJECT
Description
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the handle_image_upload() function in all versions up to, and including, 1.0.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.
<p>Streamline your appointment booking process with WPBookit, the ultimate free appointment booking WordPress plugin. Ideal for businesses of all sizes, WPBookit offers a comprehensive suite of features designed to simplify scheduling, enhance user experience, and boost productivity.</p>
<h3>Features:</h3>
<ul>
<li>Revenue Chart Report: Gain valuable insights into your earnings with detailed revenue charts.</li>
<li>Booking Calendar/List View: View and manage bookings effortlessly with both calendar and list views.</li>
<li>Different Calendars for Different Services: Organize your services with separate calendars for each one.</li>
<li>Custom Time Slots: Customize available time slots to fit your unique business hours and needs.</li>
<li>Calendar-wise Unavailable Dates: Mark unavailable dates on individual calendars to avoid scheduling conflicts.</li>
<li>Guest Users List: Maintain a list of guest users for easy reference and follow-up.</li>
<li>Easy Email Template Editing: Customize email templates with ease for a personalized communication experience.</li>
<li>Translation Ready: Cater to a global audience with translation-ready capabilities.</li>
</ul>
<h3>Benefits:</h3>
<ul>
<li>Efficient Scheduling: Simplify the booking process with intuitive calendar and list views, ensuring smooth management of appointments.</li>
<li>Enhanced User Experience: Provide a seamless experience for both customers and staff with features like custom timeslots, email notifications.</li>
<li>Virtual Consultations: Offer convenient telemedicine services with Zoom integration, expanding your reach and flexibility.</li>
<li>Comprehensive Management: Keep track of guest users, manage multiple services, and generate detailed reports to optimize your business operations.</li>
<li>Global Reach: Serve a diverse audience with translation-ready functionality, making your services accessible to users worldwide.</li>
</ul>
<p>Elevate your appointment booking process with WPBookit – the free WordPress plugin designed to meet all your scheduling needs. <strong><a href="https://wpbookit.com" rel="nofollow ugc">WPBookit Pro</a> version is also available with advance featutes.</strong></p>
<h3>Source Code</h3>
<p>The original, non-minified source code for the JavaScript and CSS files used in this plugin can be found in the <code>core/admin/assets/src</code> directory of the plugin folder.</p>
<h3>External Services</h3>
<p>WPBookit interacts with external services to enhance functionality and provide accurate data.</p>
<h3>Services Used:</h3>
<ol>
<li>
<p><strong>ipapi.co</strong> (https://ipapi.co/)</p>
<ul>
<li><strong>Purpose</strong>: Used for geolocation purposes to automatically determine and set the user’s country based on their IP address.</li>
<li><strong>Terms of Use</strong>: <a href="https://ipapi.co/terms/" rel="nofollow ugc">ipapi.co Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co Privacy Policy</a></li>
</ul>
</li>
<li>
<p><strong>Google Fonts</strong> (https://fonts.googleapis.com/)</p>
<ul>
<li><strong>Purpose</strong>: The plugin uses the “Plus Jakarta Sans” font, which is loaded from Google Fonts to enhance the visual appearance of the plugin.</li>
<li><strong>Terms of Use</strong>: <a href="https://developers.google.com/fonts/terms" rel="nofollow ugc">Google Fonts Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google Fonts Privacy Policy</a></li>
</ul>
</li>
<li>
<p><strong>Add to Calendar Pro API</strong> (https://add-to-calendar-pro.com/)</p>
<ul>
<li><strong>Purpose</strong>: Used to add booking details directly to users’ calendars.</li>
<li><strong>Terms of Use</strong>: <a href="https://add-to-calendar-pro.com/terms/" rel="nofollow ugc">Add to Calendar Pro Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://add-to-calendar-pro.com/privacy-policy/" rel="nofollow ugc">Add to Calendar Pro Privacy Policy</a></li>
</ul>
</li>
</ol>
<p>By using WPBookit, you agree to the terms and conditions outlined by these external services.</p>