Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Liquid Web BookIt plugin allows database tampering

CVE-2026-62048 · published 1 day ago
Summary

The BookIt scheduling plugin for WordPress does not properly verify data that users submit. An attacker could send specially crafted information to change or read data stored in your website’s database. Update the plugin to the latest version (or remove it if you cannot update) and limit data entry to trusted users.

What to do
  • Update liquid web / stellarwp bookit to version 2.6.0.7.
Affected software
VendorProductAffected versions
liquid web / stellarwp bookit <= 2.6.0.6
Fix: upgrade to 2.6.0.7
Original advisory text
WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-89SQL Injection
Timeline
Published1 Nov 2026
Updated2 Nov 2026
First seen1 Nov 2026
Sources
CVE-2026-62048 · NVD
CVE-2026-62048 · MITRE
Track software like this
Free during beta