CVE-2026-25439: WordPress Booknetic plugin <= 4.8.5 - Account Takeover vulnerability

Synopsis

A broken authentication vulnerability in the Booknetic WordPress plugin (versions 4.8.5 and earlier) allows an unauthenticated remote attacker to bypass login controls entirely. The flaw is reachable over the network and requires no credentials or user interaction, though exploitation depends on specific environmental conditions. Successful exploitation gives the attacker full control over targeted accounts, enabling them to read, modify, or destroy data associated with those accounts. HarborGuard is tracking this advisory for patch availability and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress installation over the network; the vulnerable authentication endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No credentials of any kind are needed; the vulnerability exists in the pre-authentication layer and can be triggered by an anonymous request.

• Victim interactionNot required

  The attacker does not need to trick or wait for any user to take action; exploitation is entirely server-side.

• Attack complexityDetail

  Attack complexity is rated High, meaning exploitation is not unconditional and likely depends on specific environmental factors such as account state, timing, or configuration that the attacker must identify or satisfy before the bypass succeeds.

Blast Radius

• A successful attacker takes over the targeted account, gaining the same access level as that account within WordPress and Booknetic, including stored booking records, customer personal data, and payment details.
• If the compromised account holds administrative privileges, the attacker can modify or delete all booking data, alter plugin configuration, and potentially install malicious WordPress plugins.
• All data stored in the Booknetic appointment system, including names, contact information, and scheduling history, becomes readable by the attacker.
• The attacker can corrupt or destroy Booknetic booking records, disrupting availability of the appointment scheduling service for end users.