CVE-2025-12685
Medium · 6.5CVSS
6.5
EPSS
0.1%
Published
Jan 2, 2026
CISA due date
—
The record
The WPBookit WordPress plugin through 1.0.7 lacks a CSRF check when deleting customers. This could allow an unauthenticated attacker to delete any customer through a CSRF attack.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|