BookIt EUVD-2026-33948

Exploitation requires the BookIt WordPress plugin to be installed and active at a version before 2.5.4.1, with its password-recovery feature reachable over the network (the default for a WordPress site exposing /wp-admin or the plugin's front-end booking pages). No authentication, no user interaction, and no special configuration toggle is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N), and the attacker only needs to know or guess a valid target username or email address registered with the plugin. Limiting factors are narrow: the site must run this specific plugin at a vulnerable version, and impact scope is bounded by the privilege level of the targeted account.

The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction and high integrity impact only - consistent with an account-takeover primitive rather than data theft or DoS. The fact that confidentiality and availability are marked None is notable: an attacker can alter authentication state (hijack an account) but the CVSS scoring does not credit the downstream data exposure that account takeover usually enables, so real-world impact may exceed the 7.5 base score depending on the privileges of the hijacked account (especially if administrators use BookIt accounts). EPSS, KEV, and SSVC data were not provided in the input, and no POC reference was supplied - so exploitation likelihood beyond the CVSS-derived ease cannot be quantified. There is no public exploit identified at time of analysis, but the low-complexity unauthenticated profile combined with broad WordPress plugin attack surface means defenders should treat this as a near-term patching priority.

A remote unauthenticated attacker sends a crafted request to the BookIt password recovery endpoint on a vulnerable WordPress site, exploiting the alternate-channel weakness to obtain a valid reset link or token for a chosen account without proving ownership of the associated email. The attacker then sets a new password and logs in as that user, gaining whatever booking, customer, or administrative privileges that account holds. No public POC was supplied in the source data, but the AC:L / PR:N / UI:N vector indicates the chain is straightforward once the vulnerable endpoint is identified.