Executive brief
The Bookit WordPress plugin for managing bookings and appointments contains an authorization flaw that allows low-level Staff users to delete appointments they should not have access to. An attacker with a Staff role account could delete any appointment in the system, disrupting the business's scheduling operations and customer experience without proper administrative oversight.
Technical details
The vulnerability is a missing authorization check (CWE-862) in an appointment-deletion function within The Bookit WordPress plugin before version 2.6.0.5. The plugin fails to verify that a user has the required capability before processing deletion requests, allowing users assigned the low-privileged custom Staff role to delete arbitrary appointments. The vulnerability is exploitable by any authenticated user with Staff role access to the WordPress site. An attacker can delete appointments belonging to other staff members or customers, causing operational disruption. The vendor has patched this issue in version 2.6.0.5.
Affected products
- Bookit The Bookit — Booking & Appointment Calendar before 2.6.0.5
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: Fixed in version 2.6.0.5