Who is not affected by CVE-2026-62048?

Not affected if: plugin-deactivated, plugin-not-installed.

Live › vulnerability › CVE-2026-62048

critical9.3Package

BookIt WordPress plugin: SQL injection lets attackers read or change database

BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has an SQL injection flaw in versions through 2.6.0.6. An attacker can inject database commands through its inputs to read or alter site data.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Nov 1, 2026 UTC
Last modified: Nov 1, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-01 16:20 UTC. All times on this page are UTC.

Who is affected

1 product

Sites running the BookIt booking plugin for WordPress at version 2.6.0.6 or earlier. The sources do not say which plugin features or inputs are reachable without login, so the exact exposure is unknown.

Product	Ecosystem	Affected	Fixed in
bookit	wordpress	<= 2.6.0.6	2.6.0.7

Who cares: bookit, liquid-web, sql-injection, stellarwp, wordpress, wordpress-plugin
Not affected if: plugin-deactivated, plugin-not-installed

How to check

In WordPress admin > Plugins, check the BookIt (Bookit — Booking & Appointment Calendar) version; 2.6.0.6 and earlier are listed as affected.
Or run: wp plugin list --name=bookit --fields=name,status,version
If the version is below 2.6.0.7, update. The public booking form/AJAX endpoint is the likely exposed path, but no source names the vulnerable parameter.

The fix

Know the next one before it finds you.

Get started free

Live › vulnerability › CVE-2026-62048

critical9.3Package

BookIt WordPress plugin: SQL injection lets attackers read or change database

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Nov 1, 2026 UTC
Last modified: Nov 1, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-11-01 16:20 UTC. All times on this page are UTC.

Who is affected

1 product

Product	Ecosystem	Affected	Fixed in
bookit	wordpress	<= 2.6.0.6	2.6.0.7

Who cares: bookit, liquid-web, sql-injection, stellarwp, wordpress, wordpress-plugin
Not affected if: plugin-deactivated, plugin-not-installed

How to check

In WordPress admin > Plugins, check the BookIt (Bookit — Booking & Appointment Calendar) version; 2.6.0.6 and earlier are listed as affected.
Or run: wp plugin list --name=bookit --fields=name,status,version
If the version is below 2.6.0.7, update. The public booking form/AJAX endpoint is the likely exposed path, but no source names the vulnerable parameter.

The fix

Know the next one before it finds you.

Get started free

BookIt WordPress plugin: SQL injection lets attackers read or change database

Who is affected

How to check

The fix

Know the next one before it finds you.

BookIt WordPress plugin: SQL injection lets attackers read or change database

Who is affected

How to check

The fix

Know the next one before it finds you.

Who had it, and when

What the sources say, verbatim

Sources