CVE-2026-125851themagnifico52 Hotel Booking Lite

WordPress Hotel Booking Lite theme <= 2.5.1 - Arbitrary File Upload vulnerability

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.9of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-125851. Nothing runs until you send it.

About this flaw

Unrestricted Upload of File with Dangerous Type vulnerability in themagnifico52 Hotel Booking Lite hotel-booking-lite allows Upload a Web Shell to a Web Server.This issue affects Hotel Booking Lite: from n/a through 2.5.1.

Published: 13 Nov 2026
Weakness: CWE-434

What should I do about this?

Advisories and references

patchstack.compatchstack.com/database/wordpress/theme/hotel-booking-lite/vulnerability/wordpress-hotel-booking-lite-theme-2-5-1-arbitrary-file-upload-vulnerability?_s_id=cve