CVE-2025-0357: Iqonic Wpbookit RCE Vulnerability

CVE-2025-0357 Overview

CVE-2025-0357 is a critical arbitrary file upload vulnerability affecting the WPBookit plugin for WordPress. The vulnerability exists in the WPB_Profile_controller::handle_image_upload function due to insufficient file type validation, allowing unauthenticated attackers to upload arbitrary files to the affected site's server. Successful exploitation of this vulnerability could enable remote code execution, giving attackers complete control over the compromised WordPress installation.

Critical Impact

Unauthenticated attackers can upload malicious files to WordPress servers, potentially achieving remote code execution without any user interaction or authentication requirements.

Affected Products

• Iqonic WPBookit Pro plugin for WordPress versions up to and including 1.6.9

Discovery Timeline

• 2025-01-25 - CVE-2025-0357 published to NVD
• 2025-06-27 - Last updated in NVD database

Technical Details for CVE-2025-0357

Vulnerability Analysis

This vulnerability falls under CWE-434 (Unrestricted Upload of File with Dangerous Type). The WPBookit plugin, a booking management solution for WordPress, contains a critical flaw in its profile image upload functionality. The WPB_Profile_controller::handle_image_upload function fails to properly validate file types before allowing uploads to the server.

The lack of proper file type validation means that an attacker can bypass intended restrictions and upload executable files such as PHP web shells instead of legitimate image files. Since the vulnerability is exploitable without authentication, any remote attacker with network access to the WordPress site can attempt exploitation.

Root Cause

The root cause of CVE-2025-0357 is insufficient file type validation in the image upload handler. The handle_image_upload function does not adequately verify that uploaded files are legitimate images before storing them on the server. This oversight allows attackers to upload files with dangerous extensions (such as .php) that can be executed by the web server, bypassing the intended image-only upload restriction.

Attack Vector

The attack can be performed remotely over the network without requiring authentication or user interaction. An attacker can craft a malicious HTTP request to the vulnerable upload endpoint, submitting a PHP web shell or other malicious payload disguised as or alongside an image upload request.

The attack flow typically involves:

1. Identifying a WordPress site running a vulnerable version of WPBookit (version 1.6.9 or earlier)
2. Crafting a multipart form request targeting the profile image upload endpoint
3. Including a malicious PHP file in the request, potentially bypassing basic client-side validation
4. Accessing the uploaded malicious file to achieve remote code execution on the server

Detection Methods for CVE-2025-0357

Indicators of Compromise

• Unexpected PHP files or other executable scripts appearing in WordPress upload directories
• Suspicious HTTP POST requests to WPBookit profile image upload endpoints containing non-image file extensions
• Web server access logs showing requests to newly created PHP files in upload directories
• Unusual outbound network connections from the web server indicating potential reverse shell activity

Detection Strategies

• Monitor file system changes in WordPress upload directories for non-image file types (especially .php, .phtml, .phar extensions)
• Implement web application firewall (WAF) rules to inspect file upload requests for malicious content
• Review web server access logs for POST requests to /wp-admin/admin-ajax.php or plugin-specific upload endpoints with suspicious parameters
• Deploy file integrity monitoring to detect unauthorized additions to the WordPress installation

Monitoring Recommendations

• Enable detailed logging on WordPress and the web server to capture file upload attempts
• Configure alerts for new executable files created in upload directories
• Monitor for unusual process spawning from web server processes (e.g., Apache or Nginx spawning shell processes)
• Implement behavioral analysis to detect post-exploitation activities such as lateral movement or data exfiltration

How to Mitigate CVE-2025-0357

Immediate Actions Required

• Update the WPBookit plugin to the latest patched version immediately
• Audit WordPress upload directories for any suspicious or unexpected files and remove malicious content
• Temporarily disable the WPBookit plugin if an immediate update is not possible
• Review web server and WordPress logs for evidence of exploitation attempts

Patch Information

Iqonic has addressed this vulnerability in newer versions of the WPBookit plugin. Administrators should consult the IQONIC Documentation Change Log for the latest version information and update details. Additional technical information is available in the Wordfence Vulnerability Report.

Workarounds

• Implement server-side file upload restrictions at the web server level to block executable file uploads
• Configure WordPress to restrict upload file types by adding strict MIME type validation
• Use a Web Application Firewall (WAF) to filter malicious upload requests before they reach the application
• Restrict filesystem permissions on upload directories to prevent execution of uploaded files

# Configuration example - Disable PHP execution in WordPress uploads directory (Apache)
# Add to .htaccess file in wp-content/uploads/
<FilesMatch "\.php$">
    Require all denied
</FilesMatch>