CVE-2026-40780: Liquid Web / Stellarwp Bookit

High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days.

Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.

Affected products

• Liquid Web / Stellarwp Bookit: before 2.5.4.1 (fixed in 2.5.4.1)

Published 2026-06-02. Last modified 2026-07-22.