CVE-2025-12633 is a missing authorization vulnerability in the Bookit — Booking & Appointment Calendar WordPress plugin by stellarwp. The vulnerability exists because the REST API endpoint '/wp-json/bookit/v1/commerce/stripe/return' does not perform capability checks, allowing unauthenticated users to connect arbitrary Stripe accounts and receive payments. This affects all versions up to 2.5.0. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, no privileges required, no user interaction, and impact limited to integrity (unauthorized modification). No patch or official fix is currently documented.

An attacker can exploit this vulnerability to connect their own Stripe account through the vulnerable REST API endpoint without authentication. This could allow them to receive payments intended for the legitimate site owner, resulting in unauthorized financial transactions and potential fraud. The vulnerability does not impact confidentiality or availability but has a high impact on integrity due to unauthorized modification of payment-related data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable REST API endpoint if possible, such as by implementing firewall rules or disabling the plugin if feasible. Monitor for updates from stellarwp regarding patches or official mitigations. Avoid exposing the affected endpoint publicly.