WordPress Plugin Vulnerabilities

Bookingor <= 1.0.12 - Subscriber+ Category Deletion

Description

The plugin exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete plugin data.

Proof of Concept

Affects Plugins

Plugin icon
bookingor
No known fix

References

CVE
CVE-2025-12573

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Khaled Alenazi (Nxploited)
Submitter
Khaled Alenazi (Nxploited)
Verified
Yes
WPVDB ID
b6198d76-813c-4f13-8b3d-b4609095ae34

Timeline

Publicly Published
2025-12-29 (about 21 days ago)
Added
2025-12-22 (about 28 days ago)
Last Updated
2025-12-22 (about 28 days ago)

Other

Published
Title
Published
2024-04-22
Title
ARForms < 6.4.1 - Missing Authorization to Arbitrary Option Deletion
Published
2024-09-03
Title
The Ultimate WordPress Toolkit – WP Extended < 3.0.9 - Missing Authorization to Admin Username Change
Published
2025-01-03
Title
WP SecureSubmit <= 1.5.19 - Missing Authorization
Published
2025-03-31
Title
Safe Ai Malware Protection for WP <= 1.0.20 - Missing Authorization
Published
2025-12-03
Title
Frontend Admin by DynamiApps < 3.28.21 - Unauthenticated Arbitrary Options Update