CVE-2026-89007: Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A user assigned Bookit's low-privileged custom Staff role can exploit the affected appointment-deletion function. The issue enables that user to delete arbitrary appointments rather than only appointments they should be permitted to manage.
Are sites using the default WordPress roles affected?
The provided information identifies Bookit's custom Staff role as the affected low-privileged role. It does not state that default WordPress roles without that Bookit role can exploit the issue.
What should be checked while upgrading is pending?
Review which accounts have been assigned the Bookit Staff role and whether appointments have been unexpectedly deleted. Restrict or remove that role from accounts that do not require it until the plugin can be updated.