CVE-2026-110900: WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

Q: Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges and no user interaction are required.

Q: Can this be exploited remotely, and how complex is exploitation expected to be?

The issue is network-accessible and has low attack complexity according to the CVSS vector. Its assessed impact is limited to low integrity impact, with no reported confidentiality or availability impact.

Published Oct 16, 2026

Updated

Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.

Affected Software

1 affected component

Stellarwp BookIt<=2.6.0.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress BookIt plugin to a version that resolves this vulnerability.
Fixed in 2.6.0.6

Event History

Oct 16, 2026

CVE Published

via MITRE·12:51 PM

Data Sourced

via MITRE·12:51 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require an authenticated WordPress account or user interaction?

No. The CVSS vector indicates no privileges and no user interaction are required.

Can this be exploited remotely, and how complex is exploitation expected to be?