CVE-2025-12573

Description

The Bookingor WordPress plugin through 1.0.12 exposes authenticated AJAX actions without capability or nonce checks, allowing low-privileged users to delete Bookingor WordPress plugin through 1.0.12 data.

PUBLISHED Reserved 2025-10-31 | Published 2026-01-20 | Updated 2026-01-20 | Assigner WPScan

Problem types

CWE-862 Missing Authorization

Product status

Credits

Khaled Alenazi (Nxploited) finder

WPScan coordinator

References

wpscan.com/...rability/b6198d76-813c-4f13-8b3d-b4609095ae34/ exploit vdb-entry technical-description

cve.org (CVE-2025-12573)

nvd.nist.gov (CVE-2025-12573)

Download JSON