CVE-2025-7852 is a critical vulnerability in the WPBookit plugin for WordPress (versions up to and including 1.0.6) caused by unrestricted file upload due to missing validation in the image_upload_handle() function. The plugin's upload handler uses move_uploaded_file() on user-supplied files without restricting allowed file extensions or MIME types and without sanitizing filenames. This allows unauthenticated attackers to upload arbitrary files to the server, potentially enabling remote code execution. The vulnerability has a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). No patch or vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation allows unauthenticated attackers to upload arbitrary files to the affected server, which can lead to remote code execution, complete compromise of the web server, and potential further attacks on the hosting environment. The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable or remove the WPBookit plugin or restrict access to the 'add_new_customer' route to trusted users only. Implementing web application firewall (WAF) rules to block suspicious file uploads may provide temporary mitigation. Monitor vendor channels for updates and apply patches promptly once available.