Vulnerability · Published Dec 12, 2025 · Assigned by WPScan
CVE-2025-12841Bookit < 2.5.1 – Unauthenticated Settings Update
Medium 5.3
In plain English
A medium-severity security flaw in Bookit from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.7%top 46.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Nuclei
Official description
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Affected products (as reported)
References
- https://wpscan.com/vulnerability/60cb3d5f-1aa5-4858-ab84-07fe7c023fdd/ exploit, vdb-entry, technical-description