CVE-2025-12685

Description

The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.

PUBLISHED Reserved 2025-11-04 | Published 2026-01-02 | Updated 2026-01-02 | Assigner WPScan

Problem types

CWE-352 Cross-Site Request Forgery (CSRF)

Product status

Credits

Drtime finder

WPScan coordinator

References

wpscan.com/...rability/e5ba488a-b43d-4c5f-9716-4b24701999f3/ exploit vdb-entry technical-description

cve.org (CVE-2025-12685)

nvd.nist.gov (CVE-2025-12685)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.