CVE-2025-12841
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk52th percentile - higher than 52% of all known CVEs
Summary
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugin's Stripe payment options.
Risk Assessment
An unauthenticated attacker can modify the Stripe payment configuration, potentially leading to payment redirection or data leakage. The risk affects sites running the vulnerable plugin version.
Recommendation
Update the Bookit plugin to version 2.5.1 or later. Check the Stripe configuration for unauthorized changes.
Other vulnerabilities in Bookit
See all- CVE-2026-84767Medium
The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.
- CVE-2026-40780High
BookIt by Liquid Web / StellarWP before version 2.5.4.1 contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation.
Original NVD description (English source)
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS