EUVD-2026-70579
GHSA-vg3m-xq6r-8qfh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network bypass with only low integrity impact; no confidentiality or availability impact confirmed by description and CVSS signals.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Bypass Vulnerability in BookIt <= 2.6.0.3 versions.
AnalysisAI
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires only network access to a WordPress site running BookIt version 2.6.0.3 or earlier - no authentication, no special account, and no user interaction are needed (confirmed by CVSS PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 5.3 (Medium) reflects a limited-impact bypass: integrity is affected at a Low level (I:L) with no confidentiality or availability impact, suggesting the attacker cannot read sensitive data or crash the service but may be able to create, modify, or cancel bookings without authorization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the BookIt plugin to a version beyond 2.6.0.3 as soon as a patched release is available from the plugin developer or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. Rated cr
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Boo
Authentication bypass in Liquid Web / StellarWP BookIt WordPress plugin versions before 2.5.4.1 allows remote unauthenti
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today