Bookit
Monthly
Unauthenticated SQL injection in the BookIt WordPress plugin through 2.6.0.6 allows remote attackers to read data from an affected site's database, based on the assessed high confidentiality-only impact. Exploitation requires only network access to a WordPress installation with BookIt active, with no authentication or user interaction per the assessed vector, so exposure is limited to sites that have not updated past 2.6.0.6. No public exploit identified at time of analysis and no CISA KEV entry is present in the provided data, but the vuln.today decision label is act_now, so affected sites should be prioritized for remediation.
Authentication bypass in Liquid Web / StellarWP BookIt WordPress plugin versions before 2.5.4.1 allows remote unauthenticated attackers to abuse the password recovery channel to take over accounts. The flaw maps to CWE-288 (alternate path/channel) and carries a CVSS 7.5 (high) integrity impact; no public exploit identified at time of analysis, though Patchstack has catalogued the issue for the WordPress ecosystem.
Missing authorization in StellarWP BookIt through version 2.6.0.6 allows an authenticated low-privilege user, such as a self-registered subscriber, to invoke plugin functionality without the required capability check, producing limited integrity impact (CVSS 4.3). It affects WordPress sites running BookIt up to and including 2.6.0.6, requires a valid low-privilege account, and has no confidentiality or availability impact; no CISA KEV entry or public exploit was identified at time of analysis. A fixed version is not explicitly stated in the available sources, so the patched release should be confirmed with Patchstack/StellarWP.
Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.4.3. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.
Unauthenticated SQL injection in the BookIt WordPress plugin through 2.6.0.6 allows remote attackers to read data from an affected site's database, based on the assessed high confidentiality-only impact. Exploitation requires only network access to a WordPress installation with BookIt active, with no authentication or user interaction per the assessed vector, so exposure is limited to sites that have not updated past 2.6.0.6. No public exploit identified at time of analysis and no CISA KEV entry is present in the provided data, but the vuln.today decision label is act_now, so affected sites should be prioritized for remediation.
Authentication bypass in Liquid Web / StellarWP BookIt WordPress plugin versions before 2.5.4.1 allows remote unauthenticated attackers to abuse the password recovery channel to take over accounts. The flaw maps to CWE-288 (alternate path/channel) and carries a CVSS 7.5 (high) integrity impact; no public exploit identified at time of analysis, though Patchstack has catalogued the issue for the WordPress ecosystem.
Missing authorization in StellarWP BookIt through version 2.6.0.6 allows an authenticated low-privilege user, such as a self-registered subscriber, to invoke plugin functionality without the required capability check, producing limited integrity impact (CVSS 4.3). It affects WordPress sites running BookIt up to and including 2.6.0.6, requires a valid low-privilege account, and has no confidentiality or availability impact; no CISA KEV entry or public exploit was identified at time of analysis. A fixed version is not explicitly stated in the available sources, so the patched release should be confirmed with Patchstack/StellarWP.
Missing authorization in the BookIt WordPress plugin (Liquid Web / StellarWP), in all versions through 2.6.0.5, allows remote unauthenticated attackers to reach a protected plugin action that should be restricted to privileged users, resulting in unauthorized modification of site data. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) confirms exploitation is network-based, unauthenticated, low complexity and requires no user interaction, but impact is confined to integrity - there is no confidentiality or availability loss and no scope change, so this is a moderate-priority broken access control issue rather than a full site takeover. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and the exact endpoint or feature lacking the capability check is not specified in the available description and should be confirmed against the Patchstack advisory.
Unauthenticated bypass in the BookIt WordPress plugin (versions <= 2.6.0.3) allows remote attackers to circumvent an authentication or authorization control with low-integrity impact. The flaw, rooted in CWE-345 (Insufficient Verification of Data Authenticity), enables attackers to perform actions that should be restricted - likely manipulating booking-related state without holding a valid session or credentials. The vendor CPE attributes this to Nexcess (cpe:2.3:a:nexcess:bookit). No public exploit code or CISA KEV listing has been identified at time of analysis.
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes Booking Calendar | Appointment Booking | BookIt.4.3. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.