CVE-2025-63001: 
WordPress vulnerability analysis and mitigation

CVE-2025-63001 is a Missing Authorization (Broken Access Control) vulnerability in the nicdark Hotel Booking WordPress plugin (nd-booking). It allows unauthenticated remote attackers to exploit incorrectly configured access control security levels, potentially performing unauthorized privileged actions. The vulnerability affects all versions of the plugin through 3.8, with no official patch available as of the disclosure date. It was published on December 31, 2025, and carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization), meaning one or more plugin functions fail to verify whether the requesting user has the appropriate permissions before executing privileged operations. The attack vector is network-based, requires no authentication, no user interaction, and low attack complexity, making it trivially exploitable by any remote user. The specific function(s) lacking authorization checks have not been publicly detailed beyond the Patchstack disclosure, which credits researcher benzdeus with the discovery on October 28, 2025 (Patchstack).

Successful exploitation allows an unauthenticated attacker to perform actions that should be restricted to higher-privileged users, resulting in a low integrity impact with no confidentiality or availability impact per the CVSS scoring. In practice, this could mean unauthorized modification of booking data, plugin settings, or other protected functionality within the Hotel Booking plugin. While the individual impact is limited, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the priority as "Low" and notes it is "unlikely to be exploited" despite the unauthenticated attack vector (Patchstack).

As of the disclosure date (December 31, 2025), no official patch has been released by the plugin developer (nicdark). Site administrators running Hotel Booking plugin version 3.8 or earlier should consider deactivating and removing the plugin until a patched version is available. Alternatively, a Web Application Firewall (WAF) with WordPress-specific rulesets — such as Patchstack's virtual patching — can provide interim protection. Monitor the plugin's WordPress.org repository and the developer's site for an updated release (Patchstack).

The vulnerability was discovered by security researcher benzdeus and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) on December 31, 2025. No significant vendor statements, notable researcher commentary beyond the Patchstack advisory, or major media coverage have been identified for this vulnerability (Patchstack).