---
id: "CVE-2026-110900"
kind: "vulnerability"
aliases: ["CVE-2026-110900"]
title: "BookIt WordPress plugin: missing authorization check exposes booking data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["booking-plugin", "bookit", "package", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-16T13:16:55+00:00"
first_seen_at: "2026-10-23T21:57:13+00:00"
updated_at: "2026-10-25T04:27:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110900", "first_seen_at": "2026-10-23T21:57:13+00:00"}]
---

# BookIt WordPress plugin: missing authorization check exposes booking data

The BookIt booking plugin by Liquid Web and StellarWP has a missing authorization check, which the NVD entry describes as exploitable through incorrectly configured access control levels. An attacker with access to the affected endpoint may perform actions or read data they should not reach.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BookIt plugin version in the WordPress admin plugins page or with `wp plugin get bookit --field=version`
- Confirm whether the site runs BookIt at all with `wp plugin is-active bookit`

## Fix

- Update BookIt to a version later than `2.6.0.5`, as listed by the plugin vendor
- Unknown whether a patched version number is published in the sources

## Timeline

- 2026-10-23T21:57:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110900

## From the sources

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_