CVE-2025-3811 is a critical account takeover flaw (CVSS 9.8) in the WPBookit plugin for WordPress, in all versions up to and including 1.0.2. An unauthenticated attacker can change a user's email address, including an administrator's. Update the plugin to the latest release and review recent email changes.
What's affected
The record names the Iqonic WPBookit plugin for WordPress, all versions up to and including 1.0.2. The description says the plugin does not properly validate a user's identity before updating details such as an email address, in the function edit_newdata_customer_callback().
The description adds that this makes it possible for unauthenticated attackers to change arbitrary users' email addresses, including administrators, and then use a password reset to gain access to the account. The record does not list the exact fixed version. The reference is a plugin code change, so confirm the patched release in the plugin's changelog.
The record lists the weakness as CWE-639 (authorization bypass through a user controlled key). The CVSS 3.1 score is 9.8 (critical), with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The vector shows the flaw can be reached over the network, and no login is needed. Confidentiality impact is rated high, integrity high and availability high.
The record does not say this flaw is exploited in the wild, and the CISA Known Exploited Vulnerabilities flag is false. The WordPress.org plugin repository change listed in the record is the best place to see how the maintainers responded.
How to check if you're exposed
Check your WordPress installs for the plugin and its version.
- With WP-CLI, list the plugin and version on each site:
wp plugin list --fields=name,status,version | grep -i wpbookit
- Without WP-CLI, open the Plugins page in the dashboard and read the version under WPBookit. Compare it with 1.0.2, the last affected version in the record.
- Check the plugin's changelog on WordPress.org for the release that mentions this fix.
- Review your user list for administrator or customer accounts whose email address changed unexpectedly, and look at password reset emails sent around the same time:
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
If you manage many sites, the free in-browser dependency scan covers application dependencies, and the Gold directory lets you look up other CVEs by product. WordPress plugins still need to be checked on each site.
What to do now
- Update WPBookit to the latest release on every site. Confirm the version is newer than 1.0.2.
- If you cannot update right away, deactivate the plugin until you can. A booking form that is offline is better than an open account takeover path.
- Check administrator and customer accounts for email addresses you did not set, and reset passwords for any account you cannot account for.
- Turn on two factor authentication for administrators, so that a changed email address alone is not enough to take over an account.
- Review the user table for new administrator accounts and for sessions you do not recognize.
- Keep automatic updates on for plugins that have had security fixes.
Why it matters
This flaw is an authorization failure. The plugin accepted a request to change a user's details without checking that the person asking was that user. The record lists CWE-639, authorization bypass through a user controlled key. In plain terms, the plugin trusted an identifier sent in the request.
Changing an email address sounds minor, but it is a step toward taking over the account. Most sites let a user reset a password through the address on file. If an attacker controls that address, the reset email goes to them. That is how the record gets from a profile update to access to an administrator account, and why the score is 9.8.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which WPBookit version fixes CVE-2025-3811?
The record says all versions up to and including 1.0.2 are affected. It does not name the fixed release, so check the plugin changelog and install the latest version.
Do I need to be logged in to be attacked?
No. The record says unauthenticated attackers can exploit it, and the vector shows no privileges are required.
Sources
- Gold entry for CVE-2025-3811
- NVD record for CVE-2025-3811, published 2025-05-09, as summarized above
- Plugin code change listed in the record
- Wordfence entry listed in the record
Last reviewed: 18 October 2026.
