---
id: "CVE-2026-62048"
kind: "vulnerability"
aliases: ["CVE-2026-62048"]
title: "BookIt WordPress plugin: SQL injection lets attackers read or change database"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "bookit", "fixed": ["2.6.0.7"], "affected": "<= 2.6.0.6", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["bookit", "liquid-web", "package", "sql-injection", "stellarwp", "wordpress", "wordpress-plugin"]
not_affected_if: ["plugin-deactivated", "plugin-not-installed"]
published_at: "2026-11-01T16:18:15+00:00"
first_seen_at: "2026-11-01T16:20:46+00:00"
updated_at: "2026-11-01T16:23:27+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-62048", "first_seen_at": "2026-11-01T16:20:46+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-01T16:23:27+00:00"}]
---

# BookIt WordPress plugin: SQL injection lets attackers read or change database

BookIt, a WordPress booking plugin from Liquid Web and StellarWP, has an SQL injection flaw in versions through 2.6.0.6. An attacker can inject database commands through its inputs to read or alter site data.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:bookit affected <= 2.6.0.6 fixed 2.6.0.7

## How to check

- In WordPress admin > Plugins, check the BookIt (Bookit — Booking & Appointment Calendar) version; 2.6.0.6 and earlier are listed as affected.
- Or run: wp plugin list --name=bookit --fields=name,status,version
- If the version is below 2.6.0.7, update. The public booking form/AJAX endpoint is the likely exposed path, but no source names the vulnerable parameter.

## Fix

Update BookIt to the latest release, 2.6.0.7 (2026-10-29), the first release after 2.6.0.6. The WordPress.org changelog says it hardens the public booking endpoint but does not name this CVE or SQL injection; confirm against the Patchstack entry when it is published.

## Timeline

- 2026-11-01T16:20:46+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-62048
- 2026-11-01T16:23:27+00:00 analyst — No Patchstack/vendor advisory page for this CVE found yet. WordPress.org changelog shows 2.6.0.7 (2026-10-29) hardening the public booking endpoint, but does not name SQLi or this CVE; so fix is a likely, not confirmed, version. CVSS vector PR:N (Patchstack CNA) suggests unauthenticated. No PoC or exploitation seen. Nothing verified.

## Documents

- [fix] Bookit plugin page and changelog (WordPress.org) https://wordpress.org/plugins/bookit/
- [mentions] BookIt vulnerability history (Patchstack) https://patchstack.com/database/wordpress/plugin/bookit/vulnerabilities

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_