CVE-2026-40780: BookIt Authentication Bypass via Password Recovery

Technical summary

CVE-2026-40780 is an authentication bypass vulnerability (CWE-288) in BookIt that stems from improper validation in the password recovery channel. The vulnerability permits unauthenticated attackers to circumvent authentication controls via the recovery mechanism, achieving account takeover or unauthorized access. The CVSS 3.1 score of 7.5 (HIGH) reflects the network-exploitable nature with no user interaction required, though integrity impact is the primary concern rather than confidentiality loss.

Business impact

Successful exploitation enables attackers to compromise user accounts without password knowledge, potentially leading to unauthorized access to booking systems, customer data exposure, or business process disruption. For organizations relying on BookIt for scheduling or reservation management, an attack could result in account takeovers affecting customers or staff, with downstream impacts on operational continuity and customer trust.

Affected systems

BookIt versions prior to 2.5.4.1 are vulnerable. The plugin is distributed by StellarWP/Liquid Web and is commonly used for appointment and booking management. Any WordPress or web-based implementation running an affected version requires immediate attention.

Exploitability

The vulnerability is highly exploitable. It requires no authentication, no special user interaction, and can be triggered remotely over the network. The straightforward nature of the authentication bypass via password recovery makes this an attractive target for opportunistic attackers. No special tools or deep technical knowledge is required to attempt exploitation.

Remediation

Update BookIt to version 2.5.4.1 or later. Verify the installed version in your plugin settings or via administrative tools, and apply the patch immediately given the high exploitability and ease of attack. If immediate patching is not feasible, restrict access to the password recovery endpoint at the firewall or application level as a temporary measure.

Patch guidance

Upgrade BookIt to version 2.5.4.1 or any subsequent release. Consult the official StellarWP/Liquid Web advisory for specific update instructions and any interim workarounds. Test the update in a staging environment first to ensure compatibility with your WordPress installation and any dependent integrations.

Detection guidance

Monitor web logs for unusual password recovery requests, particularly multiple attempts against different user accounts in short timeframes or requests with atypical parameters. Implement logging on the password recovery endpoint to detect brute-force or enumeration patterns. Alert on successful account access immediately following password recovery requests that do not correspond to user-initiated actions.

Why prioritize this

This vulnerability should be prioritized as HIGH due to its ease of exploitation, lack of authentication requirements, and direct path to account compromise. The integrity impact allows attackers to modify bookings, impersonate users, or access sensitive customer data. Organizations using BookIt should treat this as critical until patched.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects a high-risk vulnerability: network-exploitable (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and no user interaction needed (UI:N). While confidentiality is not affected (C:N), the high integrity impact (I:H) from unauthorized account access justifies the HIGH severity rating. The scope is unchanged (S:U), limiting cross-tenant concerns but not reducing the direct threat to affected deployments.

Frequently asked questions