CVE Intelligence
Analysis AI-assisted

CVE-2026-25413: WPBookit Pro (WordPress plugin) - Unrestricted File Upload (CWE-434)

CVE-2026-25413 is a critical unrestricted file upload flaw (CWE-434) in the WPBookit Pro WordPress plugin by iqonicdesign. The record lists the affected range as n/a through 1.6.18, and the CNA Patchstack scored it 9.9 under CVSS 3.1 with network attack vector and low privileges required. No fixed version, KEV listing or confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-25413 describes an unrestricted upload of a file with a dangerous type (CWE-434) in the WPBookit Pro plugin for WordPress, identified as wpbookit-pro and published by iqonicdesign. The record lists the affected range as n/a through 1.6.18, with the '<=' notation indicating 1.6.18 is included. The CNA Patchstack assigned the entry.

Impact

  • The CVSS 3.1 vector in the record indicates network attack, low privileges required, no user interaction, changed scope, and high impact on confidentiality, integrity and availability.
  • Inference: an upload weakness of this kind may allow a user with limited access to place files on the server that the web application could later process or execute, which could lead to broader site compromise.
  • The exact exploitation path is not described in the record.

Affected products and versions

  • Product: WPBookit Pro (wpbookit-pro), a WordPress plugin from iqonicdesign.
  • Range in the record: n/a through 1.6.18 inclusive.
  • The structured affected list in the record is empty, and no fixed version is listed. A missing fixed version does not mean no fix exists; it means the record does not state one.

Exploitation status

  • The record shows CISA KEV as not listed, so no active exploitation is claimed on that basis.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The EPSS record gives a probability of 0.00328 and a percentile of 0.24128, with the date 2026-10-13 as stated in the record. These are estimates of exploitation likelihood, not evidence of exploitation.

Remediation and mitigation

  • Identify all WordPress sites running WPBookit Pro and check whether the installed version is 1.6.18 or earlier.
  • Monitor the vendor and the Patchstack advisory for a fixed release, and update as soon as one is published and tested.
  • If no fix is available and the plugin is not essential, consider deactivating or removing it.
  • Restrict who can upload files to trusted roles and review accounts with low-privilege roles.
  • Enforce server-side file type validation and prevent script execution in upload directories.
  • Keep WordPress core and other plugins updated, and review web application firewall rules for the affected functionality.

Detection guidance

  • Review upload directories for unexpected files, especially server-side script files or files with mismatched extensions and content.
  • Use file integrity monitoring on the WordPress installation and plugin directories to flag new or modified files.
  • Review web server logs for unusual requests to plugin-related upload functions and for recent account creation with low-privilege roles.
  • Treat any unexpected file found in an upload location as a possible compromise and investigate it.

Limitations of the available information

  • No fixed version, patch details or vendor statement are present in the record.
  • The affected range starts at n/a, so the earliest vulnerable version is unknown.
  • The title was not provided in the record and has been drafted here.
  • The record's source status is Deferred, and the affected and fixed structures are empty.
  • Whether a public proof of concept exists is unknown from the record.
  • The EPSS date is later than the publication date and should be verified against the current EPSS data.

Frequently asked questions

Which versions of WPBookit Pro are affected by CVE-2026-25413?

The record lists the affected range as n/a through 1.6.18, with 1.6.18 included. The structured affected list is empty, so the exact earliest vulnerable version is unknown.

Is there a fixed version available?

The record does not list a fixed version. This does not mean no fix exists, so check the vendor and the Patchstack advisory for an updated release.

Is this vulnerability being actively exploited?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.