BookIt WordPress plugin: SQL injection

Summary

The BookIt WordPress plugin for online booking and appointments, up to and including version 2.6.0.6, contains an SQL injection vulnerability (CVE-2026-62048, CVSS 9.3). Per the Patchstack record, the flaw can be exploited without authentication over the network. An attacker could read, modify or delete data in the website database, including user accounts and customer data.

Affected

• BookIt WordPress plugin up to and including 2.6.0.6 (per CVE record and Patchstack)
• Install base unclear: Wordfence lists about 231,000 downloads, Patchstack about 6,000 installations

Fixed in

• Patchstack and the CVE solution text point to version 2.6.0.7 or later. Not confirmed by the vendor for this CVE; verify on the Patchstack page and the WordPress.org changelog.

Workaround

• No vendor-stated workaround found.
• Until a fixed version is confirmed, deactivate the plugin or restrict access to its endpoints at the web server or WAF.
• Patchstack reports a mitigation rule is available; check the Patchstack page for virtual patching options.

Exploitation

• No in-the-wild exploitation or public proof of concept found at the time of writing.
• Patchstack rates the vulnerability as high priority and expects exploitation; it is classed as usable in mass-exploit campaigns.
• The CVE status at NVD is still 'Received'; KEV listing unknown.

Our recommendation

• Inventory all WordPress sites running BookIt and their versions.
• Update to version 2.6.0.7 or later once confirmed; if an update is not possible, deactivate the plugin.
• Check exposure: the plugin should not be reachable from the internet without need.
• Review database and user accounts for signs of unauthorized changes, and monitor for KEV listing and public proof-of-concept code.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Patchstack: WordPress BookIt plugin <= 2.6.0.6 SQL Injection patchstack.com
• Wordfence: BookIt plugin vulnerabilities www.wordfence.com
• WordPress.org: BookIt plugin wordpress.org
• Patchstack: BookIt plugin database patchstack.com
• VulDB 429290 vuldb.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:21.