Live › vulnerability › CVE-2026-110900
Go to dashboardThe BookIt booking plugin by Liquid Web and StellarWP has a missing authorization check, which the NVD entry describes as exploitable through incorrectly configured access control levels. An attacker with access to the affected endpoint may perform actions or read data they should not reach.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running BookIt at version 2.6.0.5 or earlier, the affected range given as 'n/a through 2.6.0.5'. Sites that do not install BookIt are not affected. The sources do not say which access control settings make the flaw reachable.
No product ranges from the sources yet.
wp plugin get bookit --field=versionwp plugin is-active bookit2.6.0.5, as listed by the plugin vendorEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-110900")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.