What is the CVSS score of EUVD-2026-33948?

EUVD-2026-33948 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of BookIt are affected by EUVD-2026-33948?

The BookIt WordPress plugin (versions before 2.5.4.1) contains an authentication bypass vulnerability in its password recovery mechanism that allows remote attackers to take over user accounts…. A patch is available.

How to fix or mitigate EUVD-2026-33948?

Within 24 hours: Inventory all WordPress installations using BookIt; document affected versions and assess user exposure. Within 7 days: Implement rate limiting on password recovery endpoints; disable the BookIt password recovery feature if operationally feasible; enforce multi-factor authentication for all user accounts. Within 30 days: Monitor vendor announcements for patch release targeting version 2.5.4.1 or later; schedule immediate deployment upon release; evaluate alternative booking plugins if BookIt remains unpatched beyond 30 days.

BookIt EUVD-2026-33948

| CVE-2026-40780 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-06-02 Patchstack

GHSA-6wpw-j4xp-qqv8

Authentication Bypass Bookit

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch available

Jun 02, 2026 - 17:01 EUVD

Analysis Generated

Jun 02, 2026 - 16:01 vuln.today

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation.

This issue affects BookIt: from n/a before 2.5.4.1.

AnalysisAI

Authentication bypass in Liquid Web / StellarWP BookIt WordPress plugin versions before 2.5.4.1 allows remote unauthenticated attackers to abuse the password recovery channel to take over accounts. The flaw maps to CWE-288 (alternate path/channel) and carries a CVSS 7.5 (high) integrity impact; no public exploit identified at time of analysis, though Patchstack has catalogued the issue for the WordPress ecosystem.

Technical ContextAI

BookIt is a WordPress booking/appointment plugin distributed by Liquid Web's StellarWP brand (CPE cpe:2.3:a:liquid_web_/_stellarwp:bookit). The weakness class is CWE-288 - Authentication Bypass Using an Alternate Path or Channel - meaning the plugin enforces authentication on its primary login path but exposes an unauthenticated secondary path (here, the password recovery / reset flow) that can be abused to achieve the same trust level as a logged-in user. Typical implementations of this bug class in WordPress plugins involve predictable reset tokens, missing nonce/permission checks on reset endpoints, or trusting attacker-supplied user identifiers when generating or consuming a reset link.

RemediationAI

Upgrade the BookIt plugin to version 2.5.4.1 or later via the WordPress plugin updater or by downloading the patched release from the vendor - this is the primary fix per the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-5-1-broken-authentication-vulnerability). If immediate patching is not possible, compensating controls include temporarily deactivating the BookIt plugin (side effect: booking functionality will be unavailable to site visitors), restricting access to the plugin's password-recovery endpoint at the web server or WAF layer (side effect: legitimate users will be unable to self-service password resets and must use admin-driven resets), and enforcing strong WordPress administrator-level controls such as 2FA on the underlying user accounts so a stolen plugin-level credential does not directly translate into a full site compromise.