WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

bookit · Missing authorization · CWE-862

Affectedbookit

FixUpdate to 2.6.0.6 or newer

PublishedOct 16, 12:51 · Patchstack

ScoredOct 16 · 5.3 · Patchstack

Exploit code publicNone known · checked 21:18 UTC

ExploitedNone known · CISA KEV checked 22:07 UTC

What we know

No known exploitation. CISA KEV, checked 22:07 UTC.

No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.

An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.

Description

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.

From Patchstack

Affected and fixed versions

ProductAffectedFixed inbookitearlier versions2.6.0.6

Exploit code

Exploit-DBnone knownMetasploitnone knownNucleinone known

References

patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-5-broken-access-control-vulnerability?_s_id=cve · patchstack.comvdb entry

Other CVEs in bookit

All 3 →

9.3WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability · CVE-2026-62048Nov 1 4.3WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability · CVE-2026-62019Oct 30 7.5WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability · CVE-2026-40780Jun 2