CVE-2026-62048: WordPress BookIt plugin <= 2.6.0.6 - SQL Injection vulnerability

Severity: critical (CVSS 9.3 v3.1)
Exploited in the wild: not listed in CISA KEV
Public exploit or detection template: none known
Published: 2026-11-01 · updated 2026-11-01
Weakness: CWE-89

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

Summary

BookIt, a WordPress booking plugin from Liquid Web / StellarWP, contains an SQL injection flaw (CWE-89) caused by improper neutralization of special elements in SQL commands. It affects all versions through 2.6.0.6 and carries a critical CVSS score of 9.3, potentially allowing an attacker to read or alter database contents. The issue is not listed in CISA KEV, so no known active exploitation is confirmed. Update to version 2.6.0.7 or later to remediate.

تحتوي إضافة BookIt لـ WordPress من Liquid Web / StellarWP على ثغرة حقن SQL (CWE-89) ناتجة عن عدم تحييد العناصر الخاصة في أوامر SQL بشكل صحيح. تؤثر الثغرة في جميع الإصدارات حتى 2.6.0.6، ودرجة خطورتها 9.3 (حرجة)، وقد تتيح للمهاجم قراءة محتويات قاعدة البيانات أو تعديلها. الثغرة غير مدرجة في CISA KEV، لذا لا يوجد تأكيد باستغلالها فعلياً. يُنصح بالترقية إلى الإصدار 2.6.0.7 أو أحدث لمعالجة المشكلة.

Affected products

Liquid Web / StellarWP BookIt: through 2.6.0.6 — fixed in 2.6.0.7

How to fix

Upgrade to a fixed version: Liquid Web / StellarWP BookIt 2.6.0.7. Check the vendor advisory for mitigations.

References

https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve

Get alerted when CVE-2026-62048 or the next vulnerability affects your stack