Description
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
Published: 2023-06-30
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-34285 The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
History

Wed, 08 Apr 2026 18:30:00 +0000

Type Values Removed Values Added
Title BookIt <= 2.3.7 - Authentication Bypass
Weaknesses CWE-288

Tue, 26 Nov 2024 17:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Stylemixthemes Bookit
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:24:43.829Z

Reserved: 2023-05-22T10:35:10.936Z

Link: CVE-2023-2834

cve-icon Vulnrichment

Updated: 2024-08-02T06:33:06.207Z

cve-icon NVD

Status : Modified

Published: 2023-06-30T02:15:08.820

Modified: 2026-04-08T19:18:19.523

Link: CVE-2023-2834

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses