Executive brief
BookPro is a WordPress plugin used for managing bookings and appointments. A security flaw allows an unauthenticated attacker to delete arbitrary files from the web server. This can lead to a complete website outage if critical system or configuration files are removed, potentially requiring a full site restoration from backups.
Technical details
The BookPro plugin for WordPress (versions 1.1.0 and below) is vulnerable to unauthenticated arbitrary file deletion due to improper limitation of a pathname to a restricted directory (CWE-22). An attacker can exploit this path traversal vulnerability via a network request without any prior authentication or user interaction. By manipulating file path parameters, an attacker can delete sensitive files on the server, including WordPress configuration files (wp-config.php) or core system files. This can result in a complete denial of service or, in some configurations, allow the attacker to trigger a re-installation process to gain administrative control. As of the advisory date, no official patch is available.
Affected products
- Ovatheme BookPro (ovabookpro) <= 1.1.0
Timeline
- 2025-11-09: other: Vulnerability reported by researcher Phat RiO
- 2026-06-12: disclosed: Vulnerability details published by Patchstack
- 2026-06-17: advisory: CVE published in NVD