CVE-2026-110900 in BookIt Plugin
Summary
by MITRE • 10/16/2026
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/16/2026
The identified security flaw represents a critical failure in access control mechanisms within the BookIt plugin, specifically affecting versions ranging from initial releases up to version 2.6.0.5 distributed by StellarWP and associated with Liquid Web infrastructure contexts. This vulnerability is classified as an insecure direct object reference or broken access control issue, where the application fails to properly verify whether a user has the necessary permissions to perform specific actions on resources they do not own or are not authorized to manage. In typical WordPress environments utilizing BookIt for appointment scheduling and booking management, this architectural weakness allows authenticated attackers with lower privilege levels, such as subscribers or contributors, to manipulate high-level administrative functions intended exclusively for administrators. The core technical flaw lies in the absence of robust server-side authorization checks when processing requests related to bookings, settings modifications, or user role assignments. Consequently, an attacker can craft malicious HTTP requests that bypass standard WordPress capability validations, effectively elevating their privileges within the application context without requiring additional authentication steps beyond a valid login session.
From a technical perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-639 Authorization Bypass Through User-Controlled Key. The exploitation vector typically involves intercepting API calls or form submissions that handle sensitive operations such as creating new bookings for other users, modifying global plugin settings, or deleting existing appointment data. Because the application relies on client-side validation or insufficient server-side checks, it trusts user-supplied input regarding resource ownership and permission levels without rigorous verification against the current session's actual capabilities. This misconfiguration enables a range of malicious activities including unauthorized modification of business logic, theft of sensitive customer data stored within booking records, and potential defacement of the website interface through administrative panel manipulation. The impact extends beyond simple privilege escalation; it compromises the integrity of the entire scheduling system, potentially leading to financial losses if paid bookings are cancelled or altered by unauthorized parties.
The operational impact of this vulnerability is severe for any organization relying on BookIt for critical business operations involving customer appointments and payments. Attackers can exploit these weaknesses to disrupt service availability by deleting essential booking data or injecting malicious configurations that alter how the system processes reservations. Furthermore, since WordPress plugins often have broad database access, successful exploitation could serve as a stepping stone for more advanced attacks such as SQL injection if input sanitization is also lacking in related fields, although the primary issue remains authorization bypass. The lack of proper role-based access control means that even users with minimal intended privileges can exert significant influence over the application's state and data integrity. This undermines trust in the platform among end-users who expect their appointment details to remain secure and immutable except by authorized staff members.
To mitigate this risk, immediate action is required for all administrators running affected versions of BookIt. The primary remediation strategy involves upgrading the plugin to a version later than 2.6.0.5 where these authorization checks have been rigorously implemented and tested. If an upgrade is not immediately feasible due to compatibility constraints with other site plugins or themes, temporary mitigations should include restricting access to the WordPress admin area via IP whitelisting for trusted networks only, ensuring that all user accounts utilize strong, unique passwords to reduce the likelihood of credential compromise which often precedes such exploitation attempts. Additionally, implementing a Web Application Firewall can help detect and block anomalous request patterns indicative of authorization bypass attacks, particularly those targeting administrative endpoints with unusual parameter structures. Regular security audits and penetration testing should be conducted post-upgrade to verify that access controls are functioning as intended across all user roles and resource types within the booking ecosystem.