{"id":"CVE-2026-62019","kind":"vulnerability","aliases":["CVE-2026-62019"],"related":[],"title":"BookIt WordPress plugin: missing authorization check exposes access control","description":"Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, lacks an authorization check on some functionality. An attacker may be able to perform actions they should not be allowed to perform, according to the advisory text.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bookit","liquid-web","package","stellarwp","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed BookIt plugin version in the WordPress admin plugin list or in the plugin's main file header.","fix":"- BookIt: versions through `2.6.0.6` are affected; a fixed version is unknown from the sources.","status":"open","published_at":"2026-10-30T19:18:31+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:40+00:00","updated_at":"2026-10-30T19:26:40+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-30T19:26:40Z","model":"claude-haiku-5-5","output":{"fix":"- BookIt: versions through `2.6.0.6` are affected; a fixed version is unknown from the sources.","reach":"internet","title":"BookIt WordPress plugin: missing authorization check exposes access control","impact":"medium","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, lacks an authorization check on some functionality. An attacker may be able to perform actions they should not be allowed to perform, according to the advisory text.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bookit","liquid-web","stellarwp"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown actions performed without proper authorization checks","analyst_note":"Find the NVD entry's CNA advisory for the affected function, the fixed version, and whether authentication is required.","how_to_check":"- Check the installed BookIt plugin version in the WordPress admin plugin list or in the plugin's main file header.\n- unknown: the sources do not name the specific endpoint or setting involved.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the BookIt booking plugin up to and including 2.6.0.6 are affected. Sites without BookIt installed can skip it. The sources do not say which specific function lacks the check or what default configuration is required.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000679,"input_tokens":4119,"output_tokens":535,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':11A,14A '-62019':12A,15A '2.6.0.6':83C 'abl':44B 'access':8A,73C 'accord':55B 'action':47B 'advisori':58B 'affect':78C 'allow':52B,69C 'attack':41B 'author':5A,35B,61C 'book':26B 'bookit':1A,16B,23B,67C,68C,79C 'check':6A,36B 'configur':72C 'control':9A,74C 'cve':10A,13A 'exploit':70C 'expos':7A 'function':39B 'incorrect':71C 'issu':77C 'lack':33B 'levels.this':76C 'liquid':18B,29B,64C 'liquid-web':17B 'may':42B 'miss':4A,60C 'n/a':81C 'packag':20B 'perform':46B,54B 'plugin':3A,27B 'secur':75C 'stellarwp':21B,32B,66C 'text':59B 'vulner':62C 'web':19B,30B,65C 'wordpress':2A,22B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the BookIt booking plugin up to and including 2.6.0.6 are affected. Sites without BookIt installed can skip it. The sources do not say which specific function lacks the check or what default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:31+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62019","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62019","severity":null,"published_at":"2026-10-30T19:18:31+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}