CVE-2025-6058 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

🎯 **Affected**: WordPress Plugin **WPBookit**. 📅 **Versions**: **1.0.4 and earlier**. 🏢 **Vendor**: iqonicdesign. If you use this booking plugin, you are at risk!

Q: Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. 🔑 **Auth**: **Unauthenticated** (No login required). ⚙️ **Config**: Exploitable via the `add_booking_type` route. Easy to trigger for any visitor.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploits**: **YES**, multiple public PoCs exist. 🔗 GitHub repos (Nxploited, 0xgh057r3c0n, zr1p3r) and Nuclei templates are available. Wild exploitation is highly likely.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Scan for WPBookit version ≤ 1.0.4. 2. Use Nuclei template `CVE-2025-6058.yaml`. 3. Check if `image_upload_handle` endpoint exists without auth checks.

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Fix**: Update WPBookit to a version **> 1.0.4**. 📝 **Reference**: Check WordPress Trac for the patch commit. Ensure the vendor has released a fixed version.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: 1. **Disable** the WPBookit plugin immediately. 2. Block access to the `add_booking_type` endpoint via WAF. 3. Restrict file upload permissions in `wp-config.php` or server config.

Q: Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. ⏱️ **Priority**: **Immediate Action Required**. Unauthenticated RCE via file upload is a top-tier threat. Patch or disable NOW!

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: WPBookit plugin has a critical **Arbitrary File Upload** flaw.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛠️ **Root Cause**: Missing **file type validation** in the `image_upload_handle()` function. <br>📉 **CWE**: CWE-434 (Arbitrary Upload of File with Dangerous Type).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

🎯 **Affected**: WordPress Plugin **WPBookit**. <br>📅 **Versions**: **1.0.4 and earlier**. <br>🏢 **Vendor**: iqonicdesign. If you use this booking plugin, you are at risk!

Q4What can hackers do? (Privileges/Data)

⚔️ **Attacker Actions**: <br>1. Upload **any file** (PHP, JSP, etc.). <br>2. Execute code on the server. <br>3. Steal sensitive data or pivot to other systems.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

📉 **Threshold**: **LOW**. <br>🔑 **Auth**: **Unauthenticated** (No login required). <br>⚙️ **Config**: Exploitable via the `add_booking_type` route. Easy to trigger for any visitor.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploits**: **YES**, multiple public PoCs exist. <br>🔗 GitHub repos (Nxploited, 0xgh057r3c0n, zr1p3r) and Nuclei templates are available. Wild exploitation is highly likely.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Scan for WPBookit version ≤ 1.0.4. <br>2. Use Nuclei template `CVE-2025-6058.yaml`. <br>3. Check if `image_upload_handle` endpoint exists without auth checks.

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Fix**: Update WPBookit to a version **> 1.0.4**. <br>📝 **Reference**: Check WordPress Trac for the patch commit. Ensure the vendor has released a fixed version.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: <br>1. **Disable** the WPBookit plugin immediately. <br>2. Block access to the `add_booking_type` endpoint via WAF. <br>3. Restrict file upload permissions in `wp-config.php` or server config.

Q10Is it urgent? (Priority Suggestion)

🚨 **Urgency**: **CRITICAL**. <br>⏱️ **Priority**: **Immediate Action Required**. Unauthenticated RCE via file upload is a top-tier threat. Patch or disable NOW!

Continue exploring

Vulnerability detail Full AI analysis (login) iqonicdesign CWE-434