{"id":"CVE-2026-62048","kind":"vulnerability","aliases":["CVE-2026-62048"],"related":[],"title":"BookIt WordPress plugin: SQL injection lets attackers read or change database","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has an SQL injection flaw in versions through 2.6.0.6. An attacker can inject database commands through its inputs to read or alter site data.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"bookit","fixed":["2.6.0.7"],"affected":"<= 2.6.0.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["bookit","liquid-web","package","sql-injection","stellarwp","wordpress","wordpress-plugin"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, check the BookIt (Bookit — Booking & Appointment Calendar) version; 2.6.0.6 and earlier are listed as affected.\n- Or run: wp plugin list --name=bookit --fields=name,status,version\n- If the version is below 2.6.0.7, update. The public booking form/AJAX endpoint is the likely exposed path, but no source names the vulnerable parameter.","fix":"Update BookIt to the latest release, 2.6.0.7 (2026-10-29), the first release after 2.6.0.6. The WordPress.org changelog says it hardens the public booking endpoint but does not name this CVE or SQL injection; confirm against the Patchstack entry when it is published.","status":"open","published_at":"2026-11-01T16:18:15+00:00","first_seen_at":"2026-11-01T16:20:46+00:00","triaged_at":"2026-11-01T16:22:41+00:00","updated_at":"2026-11-01T16:23:27+00:00","category":"package","confidence":0.55,"triage":{"at":"2026-11-01T16:22:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"BookIt WordPress plugin: SQL injection lets attackers read or change database","impact":"high","summary":"BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has an SQL injection flaw in versions through 2.6.0.6. An attacker can inject database commands through its inputs to read or alter site data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","bookit","liquid-web","stellarwp"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"database contents readable and modifiable through injected SQL queries","analyst_note":"Sources do not state a fixed version or whether authentication is required; check the NVD entry and the vendor advisory for the patched release and the vulnerable endpoint.","how_to_check":"- Check the installed BookIt plugin version in the WordPress admin under Plugins; the sources say versions through `2.6.0.6` are affected.\n- Confirm whether the BookIt plugin is active on the site.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the BookIt booking plugin for WordPress at version `2.6.0.6` or earlier. The sources do not say which plugin features or inputs are reachable without login, so the exact exposure is unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000676,"input_tokens":4122,"output_tokens":528,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Sources do not state a fixed version or whether authentication is required; check the NVD entry and the vendor advisory for the patched release and the vulnerable endpoint.","search":"'-2026':13A,16A '-62048':14A,17A '2.6.0.6':50B,94C 'affect':89C 'allow':85C 'alter':63B 'attack':7A,52B 'book':35B 'bookit':1A,18A,19B,32B,83C,84C,90C 'chang':10A 'command':56B,75C 'cve':12A,15A 'data':65B 'databas':11A,55B 'element':70C 'flaw':46B 'improp':66C 'inject':5A,26B,45B,54B,77C 'injection.this':87C 'input':59B 'issu':88C 'let':6A 'liquid':21B,38B,80C 'liquid-web':20B 'n/a':92C 'neutral':67C 'packag':23B 'plugin':3A,31B,36B 'read':8A,61B 'site':64B 'special':69C 'sql':4A,25B,44B,74C,76C,86C 'sql-inject':24B 'stellarwp':27B,41B,82C 'use':71C 'version':48B 'vulner':78C 'web':22B,39B,81C 'wordpress':2A,28B,30B,34B 'wordpress-plugin':29B","nicknames":[],"mitigations":[],"who_affected":"Sites running the BookIt booking plugin for WordPress at version `2.6.0.6` or earlier. The sources do not say which plugin features or inputs are reachable without login, so the exact exposure is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T16:18:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62048","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62048","severity":null,"published_at":"2026-11-01T16:18:15+00:00","modified_at":"2026-11-01T16:18:15+00:00","first_seen_at":"2026-11-01T16:20:46+00:00","fetched_at":"2026-11-01T16:20:46+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-62048:1310","url":null,"severity":null,"published_at":"2026-11-01T16:23:27+00:00","modified_at":"2026-11-01T16:23:27+00:00","first_seen_at":"2026-11-01T16:23:27+00:00","fetched_at":"2026-11-01T16:23:27+00:00","note":"No Patchstack/vendor advisory page for this CVE found yet. WordPress.org changelog shows 2.6.0.7 (2026-10-29) hardening the public booking endpoint, but does not name SQLi or this CVE; so fix is a likely, not confirmed, version. CVSS vector PR:N (Patchstack CNA) suggests unauthenticated. No PoC or exploitation seen. Nothing verified."}],"documents":[{"id":39713,"url":"https://wordpress.org/plugins/bookit/","title":"Bookit plugin page and changelog (WordPress.org)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":39714,"url":"https://patchstack.com/database/wordpress/plugin/bookit/vulnerabilities","title":"BookIt vulnerability history (Patchstack)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}