{"id":"CVE-2026-110900","kind":"vulnerability","aliases":["CVE-2026-110900"],"related":[],"title":"BookIt WordPress plugin: missing authorization check exposes booking data","description":"Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.","summary":"The BookIt booking plugin by Liquid Web and StellarWP has a missing authorization check, which the NVD entry describes as exploitable through incorrectly configured access control levels. An attacker with access to the affected endpoint may perform actions or read data they should not reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booking-plugin","bookit","package","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed BookIt plugin version in the WordPress admin plugins page or with `wp plugin get bookit --field=version`\n- Confirm whether the site runs BookIt at all with `wp plugin is-active bookit`","fix":"- Update BookIt to a version later than `2.6.0.5`, as listed by the plugin vendor\n- Unknown whether a patched version number is published in the sources","status":"open","published_at":"2026-10-16T13:16:55+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","triaged_at":"2026-10-25T04:27:20+00:00","updated_at":"2026-10-25T04:27:20+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:27:20Z","model":"claude-haiku-5-5","output":{"fix":"- Update BookIt to a version later than `2.6.0.5`, as listed by the plugin vendor\n- Unknown whether a patched version number is published in the sources","reach":"internet","title":"BookIt WordPress plugin: missing authorization check exposes booking data","impact":"medium","summary":"The BookIt booking plugin by Liquid Web and StellarWP has a missing authorization check, which the NVD entry describes as exploitable through incorrectly configured access control levels. An attacker with access to the affected endpoint may perform actions or read data they should not reach.","category":"package","nicknames":[],"who_cares":["wordpress","bookit","booking-plugin"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Unauthorized users may read or change booking data","analyst_note":"Check the NVD entry and the Wordfence or vendor advisory for the fixed version and which endpoint lacks the authorization check.","how_to_check":"- Check the installed BookIt plugin version in the WordPress admin plugins page or with `wp plugin get bookit --field=version`\n- Confirm whether the site runs BookIt at all with `wp plugin is-active bookit`","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running BookIt at version `2.6.0.5` or earlier, the affected range given as 'n/a through 2.6.0.5'. Sites that do not install BookIt are not affected. The sources do not say which access control settings make the flaw reachable.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000613,"input_tokens":3311,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-110900':12A,15A '-2026':11A,14A '2.6.0.5':90C 'access':46B,52B,80C 'action':59B 'affect':55B,85C 'allow':76C 'attack':50B 'author':5A,34B,68C 'book':8A,17B,24B 'booking-plugin':16B 'bookit':1A,19B,23B,74C,75C,86C 'check':6A,35B 'configur':45B,79C 'control':47B,81C 'cve':10A,13A 'data':9A,62B 'describ':40B 'endpoint':56B 'entri':39B 'exploit':42B,77C 'expos':7A 'incorrect':44B,78C 'issu':84C 'level':48B 'levels.this':83C 'liquid':27B,71C 'may':57B 'miss':4A,33B,67C 'n/a':88C 'nvd':38B 'packag':20B 'perform':58B 'plugin':3A,18B,25B 'reach':66B 'read':61B 'secur':82C 'stellarwp':30B,73C 'vulner':69C 'web':28B,72C 'wordpress':2A,21B","nicknames":[],"mitigations":[],"who_affected":"Sites running BookIt at version `2.6.0.5` or earlier, the affected range given as 'n/a through 2.6.0.5'. Sites that do not install BookIt are not affected. The sources do not say which access control settings make the flaw reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T13:16:55+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110900","severity":null,"published_at":"2026-10-16T13:16:55+00:00","modified_at":"2026-10-16T15:19:36+00:00","first_seen_at":"2026-10-23T21:57:13+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}