{"id":"CVE-2026-62048","published":"2026-11-01T16:18:15.170","lastModified":"2026-11-01T18:18:11.907","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"SQL injection flaw in Liquid Web / StellarWP BookIt plugin (v2.6.0.6 and earlier) allows unauthenticated attackers to execute arbitrary SQL queries via unsanitized user input.","exploitability":"Highly exploitable due to network accessibility, no authentication or user interaction required.","blast_radius":"Successful exploitation could lead to full database compromise (exfiltration of sensitive data), though availability impact is limited to low severity per CVSS.","remediation":"Upgrade to BookIt version 2.6.0.7 or later, as this is the first fixed version following the affected range.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","web","no-auth","owasp-top-10"],"model":"garnet-coder","analyzedAt":"2026-11-02T09:51:20.798Z"}}