CVE-2025-0357 is a critical vulnerability in the WPBookit WordPress plugin (versions ≤ 1.6.9) caused by insufficient validation of uploaded file types in the WPB_Profile_controller::handle_image_upload function. This flaw permits unauthenticated attackers to upload arbitrary files to the server hosting the plugin, potentially leading to remote code execution. The vulnerability is categorized under CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a CVSS 3.1 base score of 9.8, reflecting its high impact and ease of exploitation over the network without privileges or user interaction. No patch or official remediation guidance is currently documented.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, which can lead to remote code execution. This compromises the confidentiality, integrity, and availability of the affected system. Given the critical CVSS score of 9.8, the vulnerability poses a severe risk to sites running vulnerable versions of the WPBookit plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or remove the WPBookit plugin if possible, or restrict file upload capabilities at the web server level to prevent arbitrary file uploads. Monitor for updates from Iqonic Design regarding a security patch.