CVE-2025-7852

This vulnerability is like leaving a “file drop” door on your website that doesn’t require a key. Attackers can use that door to upload dangerous files, which can then let them enter your website again later (even after their first attempt).

This matters if you run WordPress with the WPBookit plugin installed, especially versions 1.0.6 or older. Because the upload problem does not require a login, attackers can attempt it directly over the network.
Reachability: only a risk if the affected upload feature is reachable on your site (for example, your site exposes that route in its default setup or configuration).

This is RED because there are real-world reports of attackers actively scanning and exploiting WordPress sites to deploy webshells. The flaw is unauthenticated and directly network-reachable when that upload endpoint is exposed, so attackers don’t need a stolen account to try it.
No official fix information was available in the provided sources, so the immediate priority is reducing exposure (disable/remove) and hunting for any malicious uploads already present.

1. Confirm exposure (today)

   • In WordPress admin, go to Plugins and find “WPBookit”. Record the installed version.
   • If version is 1.0.6 or older: treat the site as at risk.

2. Remove the ability to upload (immediate containment)

   • Disable the WPBookit plugin and/or remove it from your WordPress installation.
   • If you must keep it temporarily, restrict access as much as possible at your web server/WAF level (for example, block external access to the specific upload handler route if you can identify it in your setup).

3. Check for a vendor fix

   • Our sources did not include any patch version details for CVE-2025-7852. Monitor WPBookit’s vendor release notes for an update that fixes the image upload validation issue and upgrade immediately once an official fixed version is published.

4. Search for compromise (same day)

   • Inspect your WordPress upload directories (commonly the “uploads” area) for recently created/modified files that look like scripts, webshells, or unexpected file types.
   • Review web server access logs and WordPress/plugin logs for POST requests or “upload” activity related to the affected route/function.
   • If you find suspicious files: remove them and rotate any exposed credentials (especially WordPress admin accounts and any linked hosting control panel accounts).

5. After remediation

   • Re-check the WPBookit version and confirm it is upgraded once a fixed release exists.
   • Keep monitoring logs for continued upload attempts to the plugin’s upload endpoint (even after disabling/removing, attackers may keep trying).

Severity is effectively CRITICAL based on the CVSS vector and the reported impact: unauthenticated arbitrary file upload (CWE-434) leading to potential remote code execution. Findings indicate no authentication is required and no user interaction is required; exploitation is reported YES with mention of a global exploitation campaign where attackers scan WordPress sites and deploy webshells for persistent access. KEV (CISA Known Exploited Vulnerabilities) was not listed in the provided sources, but press/exploitation reporting is sustained.

Mechanism: a missing validation check in WPBookit’s image upload handler (image_upload_handle) allows arbitrary file types to be uploaded. The handler uses move_uploaded_file() on client-supplied files without restricting allowed extensions/MIME types and without sanitizing the filename. For attackers, this can enable uploading webshell-like payloads that execute when requested.

Exploit maturity: exploitation is actively reported in the wild (campaign/scanning + webshell deployment), indicating weaponized use rather than a purely theoretical flaw. EPSS was provided as 1.2% with a flat trend, but real-world exploitation (press + “exploitation reported: YES”) takes precedence over prediction for urgency.

Patch status: no fix/patch information was available in the provided sources, so a definitive fixed version number cannot be given here.