Live › vulnerability › CVE-2026-62019
BookIt, a WordPress booking plugin from Liquid Web and StellarWP, lacks an authorization check on some functionality. An attacker may be able to perform actions they should not be allowed to perform, according to the advisory text.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the BookIt booking plugin up to and including 2.6.0.6 are affected. Sites without BookIt installed can skip it. The sources do not say which specific function lacks the check or what default configuration is required.
No product ranges from the sources yet.
2.6.0.6 are affected; a fixed version is unknown from the sources.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2026-62019")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.