Medium severity5.3NVD Advisory· Published Nov 8, 2025· Updated Apr 15, 2026

CVE-2025-12042

Description

The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data.

Affected products

WordPress/Course Booking Systemllm-fuzzy
Range: <=6.1.5
Package: https://wordpress.org/plugins/course-booking-system

Patches

Vulnerability mechanics

References

plugins.trac.wordpress.org/changesetnvd
www.wordfence.com/threat-intel/vulnerabilities/id/38b2b477-5b8a-42c2-b346-57707d9a34a5nvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000