CVE-2026-62048: BookIt WordPress Plugin SQL Injection
A critical SQL injection vulnerability (CWE-89) was published on November 1, 2026 in BookIt, the appointment-booking WordPress plugin from Liquid Web / StellarWP. Tracked as CVE-2026-62048 with a CVSS 3.1 score of 9.3, the flaw affects all versions through 2.6.0.6. Patchstack assigned the CVE.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-62048 |
| CVSS Score | 9.3 (Critical) — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L |
| CWE Classification | CWE-89 — SQL Injection |
| Affected Software | BookIt (WordPress plugin) through 2.6.0.6 |
| Attack Vector | Network |
| Authentication Required | None |
| Published | November 1, 2026 |
| Exploitation | No confirmed public exploit; not listed in CISA KEV |
Technical Description
The plugin fails to neutralize special elements in input used to build an SQL command. The vector indicates the flaw is reachable over the network with no authentication or user interaction, and the changed scope (S:C) reflects impact beyond the plugin itself, with high confidentiality impact on the WordPress database. The vulnerable function or endpoint has not been publicly detailed, and NVD analysis was pending at publication.
An attacker could extract data from the WordPress database, including customer booking records, user accounts and password hashes.
Impact Assessment
| Impact Area | Description |
|---|---|
| Confidentiality | Booking and customer data, user records and hashes exposed |
| Integrity | Rated none by the CVSS vector |
| Availability | Limited impact from heavy or malformed queries |
Remediation Guidance
- Update BookIt to 2.6.0.7 or later. One source disputes whether a fixed release is available, so confirm the installed version in the WordPress admin or the plugin's changelog.
- If no fix is available, deactivate the plugin until the vendor ships one.
- Deploy WAF rules that block common SQL injection patterns as a compensating control.
- Review logs for unusual requests to booking endpoints and unexpected database errors.
- Rotate credentials and review administrator accounts if exploitation is suspected.
Key Takeaways
- BookIt 2.6.0.6 and earlier has an unauthenticated SQL injection rated CVSS 9.3
- Update to 2.6.0.7 or later, verifying the fix is actually published
- Use a WAF and log review while patching
- Remove unused WordPress plugins to shrink attack surface