CVE-2025-12042 Course Booking System <= 6.1.5 - Missing Authorization to Unauthenticated Booking Data Export
Unauthenticated attackers can access booking data exports due to missing capability checks in the Course Booking System WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-12042?
CVE-2025-12042 is a medium-severity missing authorization vulnerability in werbeagenturcommotion Course Booking System, published on 8 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Course Booking System plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in the csv-export.php file in all versions up to, and including, 6.1.5. This makes it possible for unauthenticated attackers to directly access the file and obtain an export of all booking data.
Weakness: CWE-862
Which versions are affected by CVE-2025-12042?
How do I fix CVE-2025-12042?
No fix has been published for CVE-2025-12042 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-12042 being exploited?
There is no known exploitation of CVE-2025-12042 in the wild and no public exploit code.
Sources
Also known as GHSA-4q76-wc8j-pm27.