CVE-2025-68975

MediumCVSS 4.3

Published: 30/12/2025(UTC)Updated: 07/10/2026(UTC)Translated: 07/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.31%

22th percentile - higher than 22% of all known CVEs

Summary

The Eagle Booking plugin (eagle-booking) in versions up to and including 1.3.4.3 contains an authorization bypass through user-controlled key vulnerability. This allows exploitation of incorrectly configured access control security levels.

Risk Assessment

An attacker could bypass authorization mechanisms and gain access to functions or data they should not have permissions for.

Recommendation

Update the Eagle Booking plugin to a version newer than 1.3.4.3 or remove it if not in use.

Other vulnerabilities in Eagle Booking

CVE-2025-68976Medium
The Eagle Booking plugin for WordPress contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 1.3.4.3.

Original NVD description (English source)

Authorization Bypass Through User-Controlled Key vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS