5.3
Medium
CVE-2025-12841 The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of…
Description
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugins Stripe payment options.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Bookit 2.5 | earliest → < 2.5.1 | 2.5.1 |