104 matches found
WordPress Bookit < 2.5.1 - Unauthenticated Stripe Settings Update
Bookit WordPress plugin 2.5.1 contains a broken access control vulnerability caused by a publicly accessible REST endpoint allowing unauthenticated update of Stripe payment options, letting remote attackers modify payment settings without authentication. id: CVE-2025-12841 info: name: WordPress...
CVE-2026-110900
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...
CVE-2026-110900
The Liquid Web / StellarWP BookIt WordPress plugin is vulnerable to a Broken Access Control issue (CWE-862) in versions up to and including 2.6.0.5 . The root cause is Incorrectly Configured Access Control Security Levels , specifically a Missing Authorization vulnerability. This allows an attack...
CVE-2026-110900 WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...
EUVD-2026-102863
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...
WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Alpaslan Fatih Sözer in WordPress Plugin BookIt versions = 2.6.0.5...
CVE-2026-110900: Missing Authorization
Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5...
PT-2026-115590
Name of the Vulnerable Software and Affected Versions BookIt versions prior to 2.6.0.6 Description An issue exists where missing authorization allows for the exploitation of incorrectly configured access control security levels. Recommendations Update BookIt to version 2.6.0.6 or later...
WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion vulnerability
Bookit Staff+ Arbitrary Appointment Deletion vulnerability discovered by hieus in WordPress Plugin BookIt versions 2.6.0.5...
CVE-2026-89007
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...
CVE-2026-89008
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...
CVE-2026-89007
The Bookit — Booking & Appointment Calendar WordPress plugin (versions before 2.6.0.5 ) is vulnerable to an authorization flaw. The plugin fails to perform a capability check within one of its appointment-deletion functions. This allows users assigned to the low-privileged custom Staff role to pe...
EUVD-2026-82680
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...
CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...
CVE-2026-89007 Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments...
CVE-2026-89008
The Bookit — Booking & Appointment Calendar WordPress plugin, in versions prior to 2.6.0.5 , fails to perform adequate authorization checks on specific appointment-retrieval actions. This flaw allows users with low-privilege, plugin-specific roles to access and read the appointment records of oth...
CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...
CVE-2026-89008 Bookit < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...
WordPress Bookit — Booking & Appointment Calendar plugin < 2.6.0.5 - Bookit Staff+ Appointment PII Disclosure vulnerability
Bookit Staff+ Appointment PII Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin BookIt versions 2.6.0.5...
EUVD-2026-82681
The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform an authorization check on one of its appointment-retrieval actions, allowing users with a low-privilege Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5-specific role to read other...