CVE-2025-25167 is a high severity (CVSS 8.2) missing authorization flaw in BookPress, For Book Authors, a WordPress plugin, in versions up to and including 1.2.7. An unauthenticated caller can reach actions that should be restricted. Patchstack lists no official patch, so remove the plugin or replace it.
What's affected
- Product: BookPress, For Book Authors (plugin folder
book-press), by Black and White Digital. - Affected: versions through 1.2.7.
- Fixed: Patchstack's entry says no official patch is available. Check the plugin directory for a newer release before you decide.
- Privileges: Patchstack lists the required privilege as Unauthenticated, matching the NVD vector.
- Impact: the vector shows low integrity impact and high availability impact, so data can be changed and the site's function disrupted.
How to check if you're exposed
Check whether the plugin exists on your sites and which version it is.
wp plugin list --name=book-press --fields=name,status,version
Or list the directory directly.
ls wp-content/plugins | grep -i book-press
If you manage many sites, run the same check across them. Any version up to 1.2.7 is in range. Then look at the web server logs for unusual requests aimed at the plugin's endpoints from unauthenticated visitors, especially POST requests to admin-ajax from addresses that never logged in. If book content, settings or orders look altered, compare against a recent backup.
What to do now
- Deactivate and delete BookPress if you do not rely on it, and replace it with a maintained plugin if you do.
- If you must keep it for now, restrict access to the plugin's endpoints with a firewall or hosting level rule, and watch for changes.
- Back up the site and database so you can compare and restore if content was altered.
- Review recently changed posts, settings and users for anything you did not do.
- Put the plugin on a watch list so a vendor patch gets applied when one appears.
- Audit your other plugins for abandoned ones that no longer receive fixes.
Why it matters
The class is missing authorization. The plugin exposes functionality without checking whether the visitor is allowed to use it. Nothing stops a caller who has no account.
- CWE-862 is missing authorization. The application performs an action or returns data without checking whether the caller is allowed to.
Broken access control sits at the top of the OWASP Top 10, and Patchstack tags this one as A1. WordPress plugins hit it often because handlers registered for the AJAX or REST layer run for anyone unless the developer adds a capability check and a nonce. The fix on the code side is small, which makes the missing patch a maintainer problem rather than a hard engineering one. Until a fix appears, the safest action is to take the plugin out of the picture.
Quick check
Does this need a login?
No. Patchstack lists the required privilege as Unauthenticated, so any visitor can reach it.
What is the quickest safe response?
Remove the plugin, because no official patch is listed. Replace it with a maintained alternative if you need the feature.
Sources
Last reviewed: 19 October 2026.
