CVE-2026-62048
CriticalCVSS 9.3Summary
The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.
Risk Assessment
An attacker could inject arbitrary SQL statements, potentially leading to data leakage, modification, or deletion in the WordPress database. In severe cases, control over the database server may be gained.
Recommendation
Update the BookIt plugin to a version newer than 2.6.0.6 where the vulnerability is fixed. Until then, consider disabling the plugin or restricting access to it.
Other vulnerabilities in BookIt
See all- CVE-2026-110900Medium
The BookIt plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.6.0.5.
- CVE-2026-62019Medium
The BookIt plugin (Liquid Web / StellarWP) through 2.6.0.6 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-84767Medium
The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.
- CVE-2026-40780High
BookIt by Liquid Web / StellarWP before version 2.5.4.1 contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation.
- CVE-2025-12841Medium
The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugin's Stripe payment options.
Original NVD description (English source)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS