The vulnerability CVE-2026-25413 affects the WPBookit Pro WordPress plugin by iqonicdesign, allowing an attacker with low privileges to upload files of dangerous types without restriction. This can lead to execution of malicious code and full compromise of the affected system. The issue impacts all versions up to 1.6.18. The CVSS 3.1 base score is 9.9, reflecting network attack vector, low attack complexity, no user interaction, and complete impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation can result in complete compromise of the affected WordPress site, including unauthorized code execution, data theft, and service disruption. The vulnerability allows attackers to bypass file upload restrictions and place malicious files on the server, which can be leveraged to gain full control over the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict file upload permissions to trusted users only and consider disabling the WPBookit Pro plugin if possible. Monitor for updates from iqonicdesign regarding patches or official mitigations.