CVE-2026-25415: 
WordPress vulnerability analysis and mitigation

CVE-2026-25415 is a Missing Authorization vulnerability in the WPBookit Pro WordPress plugin developed by iqonicdesign. It allows attackers to exploit incorrectly configured access control security levels, classified under CWE-862 (Missing Authorization). The vulnerability affects WPBookit Pro versions from the initial release through 1.6.18. It was published on February 19, 2026, with a CVSS status currently listed as unknown and an EPSS score of approximately 0.017% (Feedly).

The root cause is CWE-862 (Missing Authorization), meaning the plugin fails to properly verify whether a requesting user has the necessary permissions before executing sensitive actions. This class of vulnerability — also known as Broken Access Control — allows lower-privileged or unauthenticated users to invoke restricted plugin functionality that should be gated behind capability checks. The attack vector is network-based, targeting WordPress installations with the vulnerable plugin active, and exploitation requires no special preconditions beyond access to the WordPress site (Feedly).

Successful exploitation could allow unauthorized users to perform privileged actions within the WPBookit Pro plugin, such as modifying booking data, accessing sensitive reservation information, or altering plugin configurations. Depending on the specific unprotected endpoints, attackers may be able to manipulate business-critical booking workflows or escalate access within the WordPress environment. The scope is limited to sites running the affected plugin, but could expose customer data or disrupt booking services (Feedly).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2026-25415 as of the available data. The EPSS score is very low at approximately 0.017%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been identified (Feedly).

Users should update WPBookit Pro to a version beyond 1.6.18 once a patched release is made available by iqonicdesign. In the interim, site administrators should consider disabling the plugin if it is not critical to operations, or restrict access to the WordPress admin area and REST API endpoints using firewall rules or security plugins. Monitoring WordPress activity logs for unexpected access to booking-related plugin functionality is also advisable (Feedly).