CVE-2026-6960

The BookingPress Pro plugin for WordPress, up to and including version 5.6, contains an arbitrary file upload vulnerability in the bookingpress_validate_submitted_booking_form_func function [1]. The flaw arises from missing file type validation, allowing attackers to upload files with arbitrary extensions.

The vulnerability can be exploited by unauthenticated attackers, but only if a signature custom field has been added to the booking form [1]. An attacker can craft a malicious file (e.g., a PHP web shell) and upload it through the vulnerable function without authentication.

Successful exploitation results in arbitrary file upload on the server, which can lead to remote code execution [1]. An attacker could execute commands, access sensitive data, or compromise the entire WordPress site.

As of the publication date, the vulnerability affects all versions up to and including 5.6. Users are advised to update to a patched version if available, or remove the signature custom field from booking forms to mitigate the risk [1].