---
id: "CVE-2026-62019"
kind: "vulnerability"
aliases: ["CVE-2026-62019"]
title: "BookIt WordPress plugin: missing authorization check exposes access control"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["bookit", "liquid-web", "package", "stellarwp", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-10-30T19:18:31+00:00"
first_seen_at: "2026-10-30T19:25:30+00:00"
updated_at: "2026-10-30T19:26:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62019", "first_seen_at": "2026-10-30T19:25:30+00:00"}]
---

# BookIt WordPress plugin: missing authorization check exposes access control

BookIt, a WordPress booking plugin from Liquid Web and StellarWP, lacks an authorization check on some functionality. An attacker may be able to perform actions they should not be allowed to perform, according to the advisory text.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed BookIt plugin version in the WordPress admin plugin list or in the plugin's main file header.

## Fix

- BookIt: versions through `2.6.0.6` are affected; a fixed version is unknown from the sources.

## Timeline

- 2026-10-30T19:25:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62019

## From the sources

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_