CVE-2025-63012: 
WordPress vulnerability analysis and mitigation

CVE-2025-63012 is a Cross-Site Request Forgery (CSRF) vulnerability in the ThimPress WP Hotel Booking WordPress plugin. It affects all versions up to and including 2.2.8, with version 2.2.9 being the patched release. The vulnerability was reported by researcher "daroo" on October 6, 2025, and published by Patchstack on November 5, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery), meaning the plugin fails to properly validate the origin of state-changing requests. An unauthenticated attacker can craft a malicious web page or link that, when visited by an authenticated WordPress user (such as an administrator), causes the victim's browser to submit unauthorized requests to the WP Hotel Booking plugin on their behalf. Exploitation requires user interaction — specifically, a privileged user must be tricked into clicking a malicious link or visiting a crafted page. No additional privileges are required by the attacker to initiate the attack (Patchstack).

Successful exploitation allows a malicious actor to force higher-privileged users to execute unwanted actions within the WP Hotel Booking plugin under their current authentication context. The integrity impact is low (CVSS), with no confidentiality or availability impact assessed. Potential consequences include unauthorized modification of hotel booking settings, reservation data, or plugin configuration, depending on the actions exposed without CSRF protection (Patchstack).

There is no evidence of active in-the-wild exploitation or public proof-of-concept code at this time. The EPSS score is approximately 0.016% (0.000160), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class are sometimes used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Hotel Booking plugin at version 2.2.8 or earlier using tools like WPScan or Shodan.
2. Identify target action: Determine which plugin actions (e.g., booking management, settings changes) lack CSRF token validation.
3. Craft malicious request: Create an HTML page or link containing a forged form or AJAX request targeting the vulnerable plugin endpoint (e.g., a WordPress admin-post.php action).
4. Social engineering: Deliver the malicious link or page to an authenticated administrator or privileged user via phishing email, comment, or other channel.
5. Trigger exploitation: When the victim visits the crafted page while logged into WordPress, their browser automatically submits the forged request, causing the plugin to execute the unauthorized action under the victim's session (Patchstack).

• Logs: WordPress access logs showing unexpected POST requests to plugin-related endpoints (e.g., admin-post.php or admin-ajax.php) from unusual referrer origins or with no referrer header.
• Logs: Sudden or unexplained changes to WP Hotel Booking plugin settings or booking records in the WordPress database audit trail.
• Network: HTTP requests to WordPress admin endpoints originating from external or unexpected domains in server access logs.

The vendor has released version 2.2.9 of the WP Hotel Booking plugin, which resolves this vulnerability. Site administrators should update to version 2.2.9 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If immediate update is not possible, restricting access to WordPress admin areas via IP allowlisting or a web application firewall (WAF) can reduce exposure (Patchstack).