Zero Radar
← feed
CriticalVulnerabilityCVE-2026-62048updated 1 Nov 2026, 20:25 UTC

BookIt WordPress plugin has SQL injection flaw

Attackers may be able to sneak database commands through the booking plugin's inputs, which could expose or change website data. Update the plugin to a fixed version as soon as one is available.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

What happened

The BookIt plugin by Liquid Web / StellarWP does not properly neutralize special characters in SQL commands, allowing SQL injection.

Why it is dangerous: An attacker could read or alter data in the site's database, such as customer booking details, and this is rated critical. Sites running the affected BookIt plugin are at risk.

Are you affected?

You are affected if you run the BookIt plugin (bookit) from any version through 2.6.0.6.

BookIt (bookit) through 2.6.0.6

What to do

  1. Check your installed BookIt version and update if it is 2.6.0.6 or earlier
  2. Watch the vendor's advisory for a patched release and install it when available
  3. If you cannot update promptly, consider temporarily disabling the BookIt plugin

Timeline

  1. 1 Nov 2026, 16:18 UTC
    Publicly disclosed
  2. 1 Nov 2026, 16:18 UTC
    Reported by NVD · NVD
  3. 1 Nov 2026, 16:22 UTC
    Picked up by Zero Radar
  4. 1 Nov 2026, 20:25 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-62048 · GHSA-fqhx-4vhr-rp48
CVSS
9.3 / 10
Disclosed
1 Nov 2026, 16:18 UTC
On Zero Radar
1 Nov 2026, 16:22 UTC (4 min after disclosure)
Last change
1 Nov 2026, 20:25 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

BookIt WordPress plugin has SQL injection flaw · Zero Radar