Is CVE-2026-40780 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-40780 being exploited in the wild.

How severe is CVE-2026-40780?

High severity, with a CVSS score of 7.5, published 2 June 2026.

Is there a fix for CVE-2026-40780?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-40780 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-40780?

Check whether you run StellarWP BookIt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-40780: StellarWP BookIt authentication bypass in password recovery

CVE-2026-40780 · Severity: high · CVSS 7.5 · Published 2026-06-02

The BookIt plugin for WordPress, used for managing appointments and bookings, contains a security flaw in its authentication system. An unauthorized attacker could exploit this vulnerability to bypass security checks during the password recovery process. This could allow an attacker to gain administrative access to the website, potentially leading to full site takeover and data exposure.

Technologies: StellarWP BookIt. Vendors: StellarWP.

Quick answers

Is CVE-2026-40780 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-40780 being exploited in the wild.
How severe is CVE-2026-40780?: High severity, with a CVSS score of 7.5, published 2 June 2026.
Which products and versions are affected?: StellarWP BookIt up to 2.5.1.
Is there a fix for CVE-2026-40780?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-40780 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-40780?: Check whether you run StellarWP BookIt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An Authentication Bypass Using an Alternate Path or Channel (CWE-288) exists in the StellarWP BookIt plugin for WordPress. The vulnerability resides in the password recovery logic, where insufficient validation allows an attacker to bypass standard authentication requirements. This is an unauthenticated, network-reachable attack with low complexity. Successful exploitation allows a malicious actor to manipulate the password reset process to gain access to accounts, including those with high privileges. The issue is addressed in version 2.5.4.1.

Affected products

StellarWP / Liquid Web BookIt up to 2.5.1

Timeline

2026-03-11: other: Vulnerability reported by researcher
2026-04-22: advisory: Patchstack advisory published
2026-06-02: disclosed: CVE published to NVD

References

https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-5-1-broken-authentication-vulnerability?_s_id=cve

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.