BookIt Plugin CVE-2026-84767

Exploitation requires only network access to a WordPress site running BookIt version 2.6.0.3 or earlier - no authentication, no special account, and no user interaction are needed (confirmed by CVSS PR:N/UI:N). The target site must have the BookIt plugin installed and active with its booking-related endpoints accessible over HTTP/HTTPS. No non-default configuration is required. Exploitation is limited in impact to integrity effects on booking data (I:L); attackers cannot read sensitive data (C:N) or cause service disruption (A:N), which constrains the practical harm to booking system abuse rather than site compromise.

The provided CVSS score of 5.3 (Medium) reflects a limited-impact bypass: integrity is affected at a Low level (I:L) with no confidentiality or availability impact, suggesting the attacker cannot read sensitive data or crash the service but may be able to create, modify, or cancel bookings without authorization. The unauthenticated, low-complexity attack vector (AV:N/AC:L/PR:N/UI:N) makes this trivially reachable from the internet - no special network position or credentials are required. However, the constrained impact (I:L, S:U) limits the real-world blast radius; this is not a path to site takeover or data exfiltration. No EPSS data, KEV listing, or public POC is present in the provided intelligence, so exploitation probability is unquantified and presumed opportunistic at most. The primary risk is booking system abuse - fraudulent reservations, appointment slot exhaustion, or unauthorized cancellations - which carries operational rather than security-critical impact for most deployments.

A remote attacker sends a crafted unauthenticated HTTP request - likely targeting a WordPress AJAX handler or REST API endpoint exposed by the BookIt plugin - that omits or bypasses the expected authentication or nonce verification check. Because the plugin does not adequately verify the authenticity of the request, it processes the action as if it were legitimate, allowing the attacker to create fraudulent bookings, modify existing appointments, or trigger restricted booking-state transitions without holding any WordPress account credentials. No public exploit code has been identified, but the low attack complexity makes manual exploitation straightforward for anyone familiar with WordPress plugin architecture.