CVE-2025-12841
BaseFortify
Publication date: 2025-12-12
Last updated on: 2025-12-12
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| bookit | bookit | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in the Bookit WordPress plugin before version 2.5.1 is that it has a publicly accessible REST endpoint which allows anyone, without authentication, to update the plugin's Stripe payment options.
How can this vulnerability impact me? :
This vulnerability could allow an attacker to modify Stripe payment settings without authorization, potentially redirecting payments or disrupting payment processing, leading to financial loss or service disruption.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided resources do not specify how this vulnerability impacts compliance with standards such as GDPR or HIPAA. However, since the vulnerability allows unauthorized modification of Stripe payment settings, it could potentially lead to unauthorized financial data manipulation or exposure, which might affect compliance with data protection regulations. No explicit compliance impact is detailed in the available information. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking if the REST endpoint `/wp-json/bookit/v1/commerce/stripe/return` is publicly accessible and allows unauthenticated updates. You can use a curl command to test this endpoint by sending a crafted request with Stripe configuration parameters. For example: `curl -X POST https://yourwordpresssite.com/wp-json/bookit/v1/commerce/stripe/return -d '{"stripe": {"stripe_user_id": "acct_HACKER", "access_token": "token", "client_id": "id", "publishable_key": "key", "client_secret": "secret"}}' -H "Content-Type: application/json"`. Additionally, an admin can verify if the Stripe user ID in the plugin settings page reflects an unexpected or attacker-controlled account such as `acct_HACKER`. Monitoring network traffic for POST requests to this endpoint without authentication can also help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate step to mitigate this vulnerability is to update the Bookit WordPress plugin to version 2.5.1 or later, where the issue has been fixed. Until the update is applied, restrict access to the vulnerable REST endpoint by implementing authentication or firewall rules to block unauthenticated requests to `/wp-json/bookit/v1/commerce/stripe/return`. Additionally, review the Stripe payment settings in the plugin to ensure no unauthorized changes have been made. [1]