Critical SQL Injection Vulnerability in BookIt Plugin

WordPress

What happened

A critical SQL injection vulnerability has been identified in the BookIt plugin for WordPress.

Are you affected?

This issue may affect users of the BookIt plugin in versions up to and including 2.6.0.6.

What to do now

1. Upgrade to a patched version of the BookIt plugin as soon as possible.
2. Review your site's security settings to limit potential exploitation of this vulnerability.
3. Check the official advisory for additional guidance.

Sources

• cve.now/CVE-2026-62048
• cve.now/GHSA-fqhx-4vhr-rp48
• CVE-2026-62048
• GHSA-fqhx-4vhr-rp48
• https://nvd.nist.gov/vuln/detail/CVE-2026-62048
• https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve
• cve.now/GHSA-FQHX-4VHR-RP48
• GHSA-FQHX-4VHR-RP48

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.