CVE-2025-52801: 
WordPress vulnerability analysis and mitigation

CVE-2025-52801 is a Missing Authorization (Broken Access Control) vulnerability in the VonStroheim TheBooking WordPress plugin. It allows unauthenticated or unauthorized attackers to access functionality not properly constrained by Access Control Lists (ACLs). The vulnerability affects TheBooking versions from n/a through 1.4.4. It was published on August 14, 2025, with a CVSS v3.1 base score of 7.3 (High) (EUVD, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before granting access to certain functionality. The attack vector is network-based with no authentication required, low attack complexity, and no user interaction needed, as reflected in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. This class of vulnerability typically arises when REST API endpoints or AJAX handlers in WordPress plugins do not implement capability checks or nonce verification, allowing any user — including unauthenticated visitors — to invoke privileged plugin functions (EUVD, Patchstack).

Successful exploitation can result in limited but meaningful impacts across confidentiality, integrity, and availability — each rated as Low in the CVSS scoring. An attacker could access restricted booking data, modify reservation records, or disrupt the booking service's normal operation without proper authorization. While the individual impact per dimension is limited, the combination and the lack of authentication requirement make this a notable risk for WordPress sites using TheBooking for appointment or reservation management (EUVD).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for CVE-2025-52801 as of the available data. The EPSS score is approximately 0.036%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The assigning organization is Patchstack, which specializes in WordPress security research (EUVD, Feedly).

Users of the TheBooking WordPress plugin should update to a version beyond 1.4.4 as soon as a patched release becomes available from the plugin developer VonStroheim. In the interim, site administrators should consider deactivating the plugin if it is not critical to operations, or restricting access to the WordPress site using a Web Application Firewall (WAF) rule targeting unauthorized access to plugin endpoints. Monitoring WordPress access logs for unexpected requests to TheBooking plugin endpoints by unauthenticated users is also advisable (Patchstack, EUVD).

Wordfence noted this vulnerability in their weekly WordPress vulnerability report covering July 28 – August 3, 2025, as part of broader coverage of broken access control issues in WordPress plugins (Wordfence). No significant additional researcher commentary or media coverage has been identified beyond standard vulnerability database listings.