StellarWP BookIt EUVD-2026-114276

Exploitation requires a valid authenticated account on the target site at low privilege level (PR:L) - on WordPress this typically means any self-registered user such as a subscriber. The missing authorization check in BookIt (CWE-862) lets such a user invoke plugin functionality without the required capability check; the exact vulnerable endpoint and trigger are not described in the available sources. Limiting factors: an attacker must already hold (or be able to register) a low-privilege account, the impact is confined to integrity (I:L) with no confidentiality or availability effect, and only BookIt versions up to and including 2.6.0.6 are affected. No fixed version is explicitly stated in the available data; verify the patched release with Patchstack/StellarWP.

This is a moderate-severity (CVSS 4.3) broken-access-control issue, and the signals consistently point to real-but-not-urgent priority rather than an emergency. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N) describes a network-reachable, low-complexity flaw that requires an authenticated low-privilege account and yields only limited integrity impact (I:L), with no confidentiality or availability consequences. No EPSS score was provided, so exploitation probability cannot be quantified. The vulnerability is NOT in CISA KEV (no confirmed active exploitation), and the single reference is the Patchstack advisory rather than working exploit code, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_month,' which aligns with a patch-on-normal-cadence posture rather than act_now/emergency. The one cross-signal tension worth noting: the input Tags label this 'Authentication Bypass,' but the CWE-862 (Missing Authorization) classification plus PR:L indicate an AUTHORIZATION flaw exploitable by an already-authenticated user, not a true pre-auth authentication bypass - this distinction materially lowers real-world risk and should be verified against the Patchstack advisory.

A user with a low-privilege account on a WordPress site running the BookIt plugin (≤2.6.0.6) sends a request to a plugin endpoint that fails to enforce a proper capability/authorization check, allowing the user to perform or alter booking-related actions they should not be permitted to. Because only integrity is affected (I:L) and no confidentiality or availability impact applies, the realistic outcome is unauthorized modification of booking data rather than data theft or site takeover. No public exploit identified at time of analysis; the only reference is the Patchstack advisory.