4.3
MediumCVSS 3.1 · from Patchstack
CVE-2026-62019
WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability
bookit · Missing authorization · CWE-862Affectedbookit
FixUpdate to 2.6.0.7 or newer
PublishedOct 30, 18:13 · Patchstack
ScoredOct 30 · 4.3 · Patchstack
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:07 UTC
What we know
No known exploitation. CISA KEV, checked 22:07 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
From Patchstack
Affected and fixed versions
ProductAffectedFixed inbookitearlier versions2.6.0.7
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known