CVE-2025-3811 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected**: **WPBookit** plugin by **iqonicdesign**. 📅 **Version**: **1.0.2 and earlier**. 🌐 **Platform**: WordPress sites running this specific plugin version.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Exploitation Threshold**: **LOW**. 🔓 **Auth**: **None required** (PR:N). 🌍 **Access**: **Network** accessible (AV:N). 🎯 **Complexity**: **Low** (AC:L). Easy to exploit remotely!

Q: Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: **No** public PoC or wild exploitation detected yet (Pocs: []). ⚠️ **Warning**: Just because there's no public code doesn't mean it's safe! The CVSS score is **HIGH (9.8)**.

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **Yes**. 🔗 **Patch**: Update to the latest version. 📝 **Reference**: See the WordPress Trac changeset for the fix in `class.wpb-customer-controller.php`.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1️⃣ **Disable** the WPBookit plugin immediately if you can't update. 2️⃣ **Restrict** access to `/wp-admin/` via IP whitelist. 3️⃣ Monitor logs for suspicious customer data edits.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. 🔴 **Priority**: **Immediate Action Required**. 💡 **Reason**: CVSS 9.8, no auth needed, high impact. Patch NOW to prevent account takeover!

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A critical security flaw in the **WPBookit** WordPress plugin. <br>🔥 **Consequences**: Attackers can bypass authentication, leading to **Account Takeover** and **Privilege Escalation**.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-639** (Authorization Bypass). <br>❌ **Flaw**: The `edit_newdata_customer_callback` function fails to properly verify user identity.…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected**: **WPBookit** plugin by **iqonicdesign**. <br>📅 **Version**: **1.0.2 and earlier**. <br>🌐 **Platform**: WordPress sites running this specific plugin version.

Q4What can hackers do? (Privileges/Data)

💀 **Hacker Actions**: <br>1️⃣ **Account Takeover**: Hijack customer/admin accounts. <br>2️⃣ **Privilege Escalation**: Gain higher permissions than intended.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Exploitation Threshold**: **LOW**. <br>🔓 **Auth**: **None required** (PR:N). <br>🌍 **Access**: **Network** accessible (AV:N). <br>🎯 **Complexity**: **Low** (AC:L). Easy to exploit remotely!

Q6Is there a public Exp? (PoC/Wild Exploitation)

🕵️ **Public Exploit**: **No** public PoC or wild exploitation detected yet (Pocs: []). <br>⚠️ **Warning**: Just because there's no public code doesn't mean it's safe! The CVSS score is **HIGH (9.8)**.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1️⃣ Check your WordPress dashboard for **WPBookit** plugin. <br>2️⃣ Verify version number: Is it **≤ 1.0.2**?…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Official Fix**: **Yes**. <br>🔗 **Patch**: Update to the latest version. <br>📝 **Reference**: See the WordPress Trac changeset for the fix in `class.wpb-customer-controller.php`.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1️⃣ **Disable** the WPBookit plugin immediately if you can't update. <br>2️⃣ **Restrict** access to `/wp-admin/` via IP whitelist. <br>3️⃣ Monitor logs for suspicious customer data edits.

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>🔴 **Priority**: **Immediate Action Required**. <br>💡 **Reason**: CVSS 9.8, no auth needed, high impact. Patch NOW to prevent account takeover!

Continue exploring

Vulnerability detail Full AI analysis (login) iqonicdesign CWE-639