BookIt CVE-2026-110900

Requires only that the BookIt WordPress plugin (Liquid Web / StellarWP) at a version from the initial release through 2.6.0.5 be installed and active on a network-reachable site; per the CVSS vector exploitation is remote and unauthenticated (AV:N/PR:N) with no user interaction (UI:N) and low complexity (AC:L), so default installations are exposed. The practical limiting factors are that the plugin must be present and at a vulnerable version, and that impact is confined to integrity (C:N/A:N, I:L) - an attacker gains unauthorized access to a specific protected action rather than full compromise. The exact endpoint/feature triggering the missing authorization is not specified in the available description and should be confirmed from the Patchstack advisory.

Signals are consistent and point to a moderate, not top-tier, priority. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a network-reachable, low-complexity, unauthenticated issue, but impact is deliberately scoped to integrity-only and low (C:N/I:L/A:N), yielding a base score of 5.3 (Medium) - this is a missing-authorization/broken-access-control flaw (CWE-862) that lets an actor reach a protected action without proper authorization, not a data-theft or RCE condition. No EPSS score was supplied in the input, so exploitation probability cannot be quantified here. There is no CISA KEV entry and no public exploit referenced, so exploitation status is 'no public exploit identified at time of analysis.' The signals do not conflict: a Medium CVSS with integrity-only impact, no KEV, and no POC collectively indicate a real but lower-urgency hardening issue rather than an actively-weaponized emergency. The one caveat is that the Patchstack description is generic ('allows Exploiting Incorrectly Configured Access Control Security Levels') and does not name the specific endpoint or action affected, so the precise security impact (what integrity change an attacker can make) cannot be confirmed from available data and should be verified against the Patchstack advisory.

An unauthenticated remote attacker sends a crafted request directly to a BookIt plugin endpoint (AJAX/REST action) that fails to check the caller's authorization, performing a booking-related action or state change they should not be permitted to make. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be issued directly against any reachable WordPress site running a vulnerable version. No public exploit code has been identified at time of analysis.