CVE-2025-6057 is a vulnerability in the iqonicdesign WPBookit WordPress plugin affecting all versions up to and including 1.0.4. The issue arises from the handle_image_upload() function lacking proper file type validation, which permits authenticated users with Subscriber-level privileges or higher to upload arbitrary files to the server. This unrestricted file upload vulnerability (CWE-434) can potentially lead to remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The CVSS v3.1 base score is 8.8, reflecting network attack vector, low attack complexity, required privileges at the low level, no user interaction, and high impact on confidentiality, integrity, and availability.

An attacker with at least Subscriber-level access can upload arbitrary files to the server hosting the WPBookit plugin, potentially enabling remote code execution. This can lead to full compromise of the affected WordPress site, including unauthorized data access, modification, or service disruption. The high CVSS score indicates a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently documented, it is recommended to restrict user privileges carefully and monitor for suspicious file uploads. Avoid granting Subscriber-level or higher access to untrusted users until a fix is available.