CVE-2026-62048
SQL Injection in StellarWP BookIt before 2.6.0.6
- CVSS 3.1
- 9.3 critical
- EPSS
- —
- Published
- ·
- Modified
SQL injection flaw in StellarWP BookIt plugin allows remote unauthenticated attackers to execute arbitrary SQL queries on WordPress sites. Triggered via network without authentication or user interaction. Attacker gains high confidentiality impact and low availability impact. Affects BookIt from n/a through 2.6.0.6.
What to do: Upgrade BookIt to a fixed version. Apply Patchstack update for CVE-2026-62048.
| Product | Affected |
|---|---|
| StellarWP BookIt | — |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.
- Ecosystems
- WordPress
- Weakness
- CWE-89
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L
In the news
0 storiesNo ingested article mentions this CVE yet.