CVE-2026-40780

HighCVSS 7.5

Published: 02/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

BookIt by Liquid Web / StellarWP before version 2.5.4.1 contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation.

Risk Assessment

An attacker can bypass authentication and gain unauthorized access to user accounts, potentially leading to data theft or account takeover.

Recommendation

Update BookIt to version 2.5.4.1 or later, which includes a fix for the vulnerability.

Other vulnerabilities in BookIt

CVE-2026-84767Medium
The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.

Original NVD description (English source)

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.