{"id":"CVE-2025-12399","title":"The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2…","summary":"The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-434"],"published":"2025-11-08","updated":"2026-10-07","sourceUpdated":"2026-10-07T21:10:00.200","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-12399","references":[{"url":"https://github.com/d0n601/CVE-2025-12399","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/browser/alex-reservations/trunk/includes/application/Alexr/Http/Controllers/UploadFileController.php#L11","label":"security@wordfence.com"},{"url":"https://plugins.trac.wordpress.org/changeset/3390614/","label":"security@wordfence.com"},{"url":"https://ryankozak.com/posts/cve-2025-12399/","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f2d97646-27a8-4302-be70-7b4fb1a12300?source=cve","label":"security@wordfence.com"}],"tags":["nvd","exploit-available"],"epss":0.00644,"epssPercentile":0.49242,"exploits":{"github":1,"githubRepos":["https://github.com/d0n601/CVE-2025-12399"],"checkedAt":"2026-10-07T21:54:50.417Z"},"exploitAvailable":true,"ingestedAt":"2026-10-07T21:54:14.994Z","slug":"CVE-2025-12399","body":"## Overview\n\nThe Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to, and including, 2.2.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}