Liquid Web / Stellarwp Bookit vulnerabilities

2 CVEs affecting Liquid Web / Stellarwp Bookit, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-110900, published 2026-10-16.

More from Liquid Web / Stellarwp.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-40780, published 2026-06-02. High severity, CVSS 7.5. EPSS: 0.5% chance of exploitation in the next 30 days. Authentication Bypass Using an Alternate Path or Channel vulnerability in Liquid Web / StellarWP BookIt allows Password Recovery Exploitation. This issue affects BookIt: from n/a before 2.5.4.1.
• CVE-2026-110900, published 2026-10-16. Medium severity, CVSS 5.3. EPSS: 0.2% chance of exploitation in the next 30 days. Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BookIt: from n/a through 2.6.0.5.