Authentication Bypass Vulnerability in Liquid Web's BookIt Plugin
CVE-2026-40780

7.5HIGH

Key Information:

Vendor

WordPress
Status
Bookit
Vendor
CVE Published:
2 June 2026

What is CVE-2026-40780?

The authentication bypass vulnerability found in Liquid Web’s BookIt plugin allows an attacker to exploit the password recovery process through an alternate path. This issue can lead to unauthorized access, compromising user accounts and sensitive information. Affected versions prior to 2.5.4.1 are especially at risk, making prompt updates and patches critical for maintaining security.

Affected Version(s)

BookIt < 2.5.4.1

References

https://patchstack.com/database/wordpress/plugin/bookit/v...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

davidfdzmorilla | Patchstack Bug Bounty Program
.