CVE-2025-12685: Unknown Wpbookit

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.

Affected products

• Unknown Wpbookit: up to and including 1.0.7

Published 2026-01-02. Last modified 2026-06-17.