The vulnerability is an authentication bypass using an alternate path or channel that allows an attacker to exploit the password recovery functionality in the Liquid Web / StellarWP BookIt plugin without proper credentials. When triggered, the flaw permits an unauthorized user to reset the password of a legitimate account, thereby gaining full access to that account and its associated resources. The weakness is classified as CWE‑288, which denotes improper authorization practices that can lead to confidentiality and integrity compromises.

Liquid Web and StellarWP publish the BookIt plug‑in for WordPress. All installations running any version prior to 2.5.4.1 are affected. The vulnerability is present in the plugin’s password‑recovery endpoint and any alternate routes that fail to enforce the required authentication checks.

The CVSS score of 7.5 marks this issue as High, and the EPSS score is not available, implying there is no current data on exploitation frequency. It is not listed in the CISA Known Exploited Vulnerabilities catalog. The attack is likely to be remote, triggered by an unauthenticated user sending a crafted request to the password‑reset path. Once the exploit is successful, the attacker can immediately assume control of the compromised account, potentially accessing or modifying sensitive data and operations within the affected WordPress site.