CVE-2025-7852
Published
CVSS v3
9.8
CRITICAL
CVSS v2
N/A
Affected
1
PROJECT
Description
The WPBookit plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the image_upload_handle() function hooked via the 'add_new_customer' route in all versions up to, and including, 1.0.6. The plugin’s image‐upload handler calls move_uploaded_file() on client‐supplied files without restricting allowed extensions or MIME types, nor sanitizing the filename. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.
<p>Streamline your appointment booking process with WPBookit, the ultimate free appointment booking WordPress plugin. Ideal for businesses of all sizes, WPBookit offers a comprehensive suite of features designed to simplify scheduling, enhance user experience, and boost productivity.</p>
<h3>Features:</h3>
<ul>
<li>Revenue Chart Report: Gain valuable insights into your earnings with detailed revenue charts.</li>
<li>Booking Calendar/List View: View and manage bookings effortlessly with both calendar and list views.</li>
<li>Different Calendars for Different Services: Organize your services with separate calendars for each one.</li>
<li>Custom Time Slots: Customize available time slots to fit your unique business hours and needs.</li>
<li>Calendar-wise Unavailable Dates: Mark unavailable dates on individual calendars to avoid scheduling conflicts.</li>
<li>Guest Users List: Maintain a list of guest users for easy reference and follow-up.</li>
<li>Easy Email Template Editing: Customize email templates with ease for a personalized communication experience.</li>
<li>Translation Ready: Cater to a global audience with translation-ready capabilities.</li>
</ul>
<h3>Benefits:</h3>
<ul>
<li>Efficient Scheduling: Simplify the booking process with intuitive calendar and list views, ensuring smooth management of appointments.</li>
<li>Enhanced User Experience: Provide a seamless experience for both customers and staff with features like custom timeslots, email notifications.</li>
<li>Virtual Consultations: Offer convenient telemedicine services with Zoom integration, expanding your reach and flexibility.</li>
<li>Comprehensive Management: Keep track of guest users, manage multiple services, and generate detailed reports to optimize your business operations.</li>
<li>Global Reach: Serve a diverse audience with translation-ready functionality, making your services accessible to users worldwide.</li>
</ul>
<p>Elevate your appointment booking process with WPBookit – the free WordPress plugin designed to meet all your scheduling needs. <strong><a href="https://wpbookit.com" rel="nofollow ugc">WPBookit Pro</a> version is also available with advance featutes.</strong></p>
<h3>Source Code</h3>
<p>The original, non-minified source code for the JavaScript and CSS files used in this plugin can be found in the <code>core/admin/assets/src</code> directory of the plugin folder.</p>
<h3>External Services</h3>
<p>WPBookit interacts with external services to enhance functionality and provide accurate data.</p>
<h3>Services Used:</h3>
<ol>
<li>
<p><strong>ipapi.co</strong> (https://ipapi.co/)</p>
<ul>
<li><strong>Purpose</strong>: Used for geolocation purposes to automatically determine and set the user’s country based on their IP address.</li>
<li><strong>Terms of Use</strong>: <a href="https://ipapi.co/terms/" rel="nofollow ugc">ipapi.co Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://ipapi.co/privacy/" rel="nofollow ugc">ipapi.co Privacy Policy</a></li>
</ul>
</li>
<li>
<p><strong>Google Fonts</strong> (https://fonts.googleapis.com/)</p>
<ul>
<li><strong>Purpose</strong>: The plugin uses the “Plus Jakarta Sans” font, which is loaded from Google Fonts to enhance the visual appearance of the plugin.</li>
<li><strong>Terms of Use</strong>: <a href="https://developers.google.com/fonts/terms" rel="nofollow ugc">Google Fonts Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://policies.google.com/privacy" rel="nofollow ugc">Google Fonts Privacy Policy</a></li>
</ul>
</li>
<li>
<p><strong>Add to Calendar Pro API</strong> (https://add-to-calendar-pro.com/)</p>
<ul>
<li><strong>Purpose</strong>: Used to add booking details directly to users’ calendars.</li>
<li><strong>Terms of Use</strong>: <a href="https://add-to-calendar-pro.com/terms/" rel="nofollow ugc">Add to Calendar Pro Terms of Service</a></li>
<li><strong>Privacy Policy</strong>: <a href="https://add-to-calendar-pro.com/privacy-policy/" rel="nofollow ugc">Add to Calendar Pro Privacy Policy</a></li>
</ul>
</li>
</ol>
<p>By using WPBookit, you agree to the terms and conditions outlined by these external services.</p>
WordPress Plugin Directory