Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%

CVE-2025-54677 — AI Deep Analysis Summary

CVSS 9.1 · Critical

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Arbitrary File Upload vulnerability in the 'Online Booking & Scheduling Calendar' plugin.…

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: CWE-434 (Unrestricted Upload of File with Dangerous Type). 🐛 **Flaw**: The plugin only checks the HTTP `Content-Type` header.…

Q3Who is affected? (Versions/Components)

👥 **Affected**: WordPress Plugin: **Online Booking & Scheduling Calendar for WordPress by vcita**. 📦 **Versions**: **4.5.3 and earlier**. ⚠️ Ensure you are not running these outdated versions.

Q4What can hackers do? (Privileges/Data)

💻 **Attacker Capabilities**: Upload PHP/webshell files. 🗝️ **Privileges**: Execute arbitrary code on the server. 📂 **Data**: Full read/write access to site files and database.…

Q5Is exploitation threshold high? (Auth/Config)

🔐 **Auth Required**: Yes. CVSS indicates **PR:H** (Privileges Required: High). 🚶 **Threshold**: Medium. You need valid WordPress admin credentials to trigger the upload endpoint. Not fully open to the public internet. 🛑

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exploit**: Yes. A PoC is available on GitHub (quetuan03/CVE-2025-54677). 🧪 **Method**: Change `Content-Type` to `image/png` but prepend file signature `GIF87a` to bypass the weak check. 📝

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: Scan for the plugin name 'Online Booking & Scheduling Calendar for WordPress by vcita'. 📊 **Version Check**: Verify if installed version is ≤ 4.5.3.…

Q8Is it fixed officially? (Patch/Mitigation)

🔧 **Official Fix**: The vendor (vcita) is expected to release a patch. 📅 **Status**: CVE published 2025-08-20. ⏳ **Action**: Check the vendor's official WordPress repository for updates > 4.5.3 immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. **Disable/Uninstall** the plugin if not essential. 2. Restrict file upload permissions via `.htaccess` or server config. 3.…

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **HIGH**. CVSS Score is **9.8** (Critical). 🚨 Even with auth required, RCE is devastating. 🏃 **Action**: Patch or disable immediately upon update availability. Do not ignore this risk!