CVE Alert: CVE-2025-12399 – alexreservations – Alex Reservations: Smart Restaurant Booking

Risk verdict

High risk of authenticated admin-level arbitrary file upload enabling potential remote code execution; remediation should be prioritised.

Why this matters

If an administrator can upload arbitrary files, attackers could place web shells or other malicious payloads on the server, leading to full site compromise, data exposure, or defacement. Real-world impact includes credential theft, lateral movement to connected systems, and disruption of guest-facing booking services.

Most likely attack path

An attacker with Administrator+ access uses the vulnerable REST endpoint to upload a crafted file without proper type validation. With network access, low complexity, and no user interaction required, they can push a payload that may be executed by the server, assuming upload validation fails. The scope remains unchanged, so the attacker’s actions stay within the current site context.

Who is most exposed

WordPress sites deploying this plugin, especially those with multiple admin accounts or weak credential hygiene, in hospitality or SMB environments where plugin usage is common and admin access is broader.

Detection ideas

• Unusual POST requests to /wp-json/srr/v1/app/upload/file from admin sessions.
• Upload of non-standard file types or PHP files into the uploads directory.
• New or modified PHP/JS files shortly after admin login or role changes.
• Admin accounts exhibiting atypical file upload activity.
• Web server logs showing repeated upload attempts targeting the endpoint.

Mitigation and prioritisation

• Apply patch to 2.2.4+ or remove/disable the upload functionality if patching isn’t feasible.
• Harden with least-privilege admin accounts; enforce MFA for all admins.
• Implement input validation or WAF rules to restrict file types and sizes; validate MIME types server-side.
• Monitor and rotate admin credentials; audit admin activity and file changes.
• Schedule patch during the next maintenance window; verify no unintended side effects post-deployment.