CVE-2026-62048: SQL Injection in BookIt WordPress Plugin

CVE-2026-62048 is a SQL Injection vulnerability discovered in the BookIt plugin by Liquid Web / StellarWP, used in WordPress for booking and appointment management. An attacker could exploit it to inject direct SQL commands into the database, compromising customer data, calendars, payments, and any sensitive information stored. BookIt is widely used on sites offering online booking services.

The vulnerability has been assigned a CVSS score of 9.3, classified as Critical. This score indicates extremely high risk: direct database access and manipulation represents the most severe compromise possible for a WordPress site. The vulnerability affects all versions from the initial release through 2.6.0.6. Signals on X (unverified as technical sources) indicate the community is already discussing the flaw, though it is not yet confirmed whether active exploitation exists or if an official patch is available.

Immediate action for IT teams is to verify BookIt installation with the command wp plugin list or through the WordPress admin panel. If the plugin is active, urgently contact Liquid Web / StellarWP for patch status. In the meantime, if BookIt is not critical for operations, disabling it is the safest choice. Once a verified patch is available, updating must be a priority. Also implement database access log monitoring to detect anomalies.

We remind that SQL Injections remain among the most critical vulnerabilities in web environments: they allow direct access to sensitive data without requiring credentials. This CVE targets a plugin that operates on the WordPress database, increasing the risk perimeter for all sites using it. Update promptness is essential.