CVE-2026-40780 Overview
CVE-2026-40780 is an authentication bypass vulnerability in the Liquid Web / StellarWP BookIt plugin for WordPress. The flaw exists in the password recovery flow and lets attackers reach authenticated functionality through an alternate channel. The issue affects all BookIt releases prior to version 2.5.4.1.
The vulnerability is classified under CWE-288: Authentication Bypass Using an Alternate Path or Channel. It is exploitable over the network without authentication or user interaction. Successful exploitation compromises integrity of the targeted WordPress account, including the potential takeover of accounts that use BookIt for scheduling.
Critical Impact
Unauthenticated attackers can abuse the BookIt password recovery mechanism to bypass authentication and gain access to user accounts on affected WordPress sites.
Affected Products
- Liquid Web / StellarWP BookIt WordPress plugin
- BookIt versions prior to 2.5.4.1
- WordPress sites using BookIt for appointment scheduling
Discovery Timeline
- 2026-06-02 - CVE-2026-40780 published to NVD
- 2026-06-02 - Last updated in NVD database
Technical Details for CVE-2026-40780
Vulnerability Analysis
The BookIt plugin exposes a password recovery workflow that fails to properly validate the requester before granting access to protected account state. An attacker can invoke this alternate authentication path to obtain access without supplying valid credentials. Because the bypass leverages a legitimate plugin endpoint, the request appears as standard WordPress traffic.
The CWE-288 classification indicates the application enforces authentication on its primary login path but leaves a secondary path effectively unprotected. In BookIt, this secondary path is the password recovery feature. Vendor fix metadata in the Patchstack advisory lists 2.5.4.1 as the first patched release.
The impact is limited to integrity, not confidentiality or availability. An attacker can modify account state or impersonate a user, but the flaw does not directly disclose stored data or crash the service. Account takeover on a WordPress site can still be chained with administrative actions to escalate impact.
Root Cause
The root cause is missing or insufficient identity verification in the BookIt password recovery routine. The plugin trusts attacker-controllable input when deciding whether to issue a credential reset or grant authenticated context. No legitimate proof of account ownership is required to complete the alternate flow.
Attack Vector
Exploitation is performed remotely over HTTP or HTTPS against the WordPress site hosting the vulnerable BookIt plugin. The attacker sends crafted requests to the plugin's password recovery endpoint. No prior authentication, privileges, or user interaction are required. Refer to the Patchstack WordPress Vulnerability Report for the disclosed technical reference.
Detection Methods for CVE-2026-40780
Indicators of Compromise
- Unexpected HTTP POST requests to BookIt password recovery endpoints from unfamiliar IP addresses.
- WordPress audit log entries showing password resets or profile changes without a corresponding user-initiated request.
- New or modified user sessions for BookIt-linked accounts originating from geolocations inconsistent with the legitimate user.
- Outbound notification emails for password resets that users did not request.
Detection Strategies
- Inspect web server access logs for repeated requests to BookIt plugin AJAX or REST endpoints associated with password recovery.
- Correlate WordPress wp_users and wp_usermeta modification timestamps with absence of legitimate admin or user activity.
- Monitor for sequential password recovery attempts targeting multiple usernames in a short window.
Monitoring Recommendations
- Enable WordPress audit logging for authentication events, password resets, and role changes.
- Forward web access logs and WordPress security events to a centralized SIEM for correlation across sites.
- Alert on any plugin file changes outside scheduled maintenance windows.
How to Mitigate CVE-2026-40780
Immediate Actions Required
- Upgrade BookIt to version 2.5.4.1 or later on every WordPress site running the plugin.
- Force a password reset for all BookIt-linked user accounts after patching.
- Invalidate active WordPress sessions to evict any attacker who may already hold authenticated state.
- Review the WordPress user list for unauthorized accounts or unexpected role changes.
Patch Information
The vendor addressed CVE-2026-40780 in BookIt version 2.5.4.1. Administrators should update through the WordPress plugin manager or by deploying the patched release from the vendor. Patch details are available in the Patchstack WordPress Vulnerability Report.
Workarounds
- If immediate patching is not possible, deactivate the BookIt plugin until the update can be applied.
- Restrict access to the WordPress site using a Web Application Firewall (WAF) rule that blocks requests to BookIt password recovery endpoints from untrusted sources.
- Limit administrative login pages and plugin endpoints to known IP ranges using server-level access controls.
- Enable multi-factor authentication on all WordPress accounts to reduce the impact of credential compromise.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
