BookIt vulnerabilities

The BookIt plugin contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 2.6.0.5.

The BookIt plugin (Liquid Web / StellarWP) contains an SQL Injection vulnerability caused by improper neutralization of special elements in SQL commands. The issue affects versions up to and including 2.6.0.6.

The BookIt plugin (Liquid Web / StellarWP) through 2.6.0.6 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.

The BookIt plugin version 2.6.0.3 and earlier contains an unauthenticated bypass vulnerability.

BookIt by Liquid Web / StellarWP before version 2.5.4.1 contains an authentication bypass vulnerability via an alternate path or channel, allowing password recovery exploitation.

The Bookit WordPress plugin before 2.5.1 has a publicly accessible REST endpoint that allows unauthenticated update of the plugin's Stripe payment options.