CVE-2025-63013: 
WordPress vulnerability analysis and mitigation

CVE-2025-63013 is a Sensitive Data Exposure vulnerability (CWE-497) in the ThimPress WP Hotel Booking WordPress plugin, affecting all versions up to and including 2.2.7. It allows authenticated attackers with low privileges to retrieve embedded sensitive system information that should not be accessible to regular users. The vulnerability was reported on October 6, 2025, by researcher "daroo" and published by Patchstack on November 5, 2025. It carries a CVSS v3.1 base score of 4.3 (Medium) (Patchstack).

The root cause is classified as CWE-497 (Exposure of Sensitive System Information to an Unauthorized Control Sphere), where the plugin exposes sensitive embedded data to actors who should not have access to it. The attack vector is network-based with low attack complexity, requiring low-level authenticated access and no user interaction. The vulnerability maps to CAPEC-170 (Web Application Fingerprinting), suggesting the exposed information could aid attackers in profiling the target system for further exploitation. No public technical write-up or proof-of-concept code has been identified beyond the Patchstack advisory (Patchstack).

Successful exploitation allows a low-privileged authenticated attacker to view sensitive information not normally accessible to regular users, impacting confidentiality only — there is no integrity or availability impact. The exposed data could be leveraged to identify further weaknesses in the system or facilitate more targeted attacks against the WordPress installation or its underlying infrastructure. The scope is limited to the affected plugin's data exposure and does not directly enable remote code execution or lateral movement (Patchstack).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been identified for CVE-2025-63013. The EPSS score is approximately 0.032% (0.000320), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this class can be used in mass-exploit campaigns targeting WordPress sites at scale, though the low severity and authentication requirement reduce immediate risk (Patchstack).

The vulnerability is patched in WP Hotel Booking version 2.2.8. Site administrators should update the plugin to version 2.2.8 or later immediately. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should contact their hosting provider or web developer for assistance (Patchstack).