CVE-2023-2834criticalCWE-288

CVE-2023-2834: critical vulnerability in stellarwp Bookit — Booking & Appointment…

BookIt <= 2.3.7 - Authentication Bypass

Published · Updated

Follow this CVE+ Monitor Bookit — Booking & Appointment Calendar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.9%
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
stellarwp · Bookit — Booking & Appointment Calendar
Related CVEs — stellarwp Bookit — Booking & Appointment…

In the same product, most dangerous first.

CVE-2022-4974MEDIUMFreemius SDK <= 2.4.2 - Missing Authorization ChecksEPSS 0.4%CVE-2025-12633HIGHBooking Calendar | Appointment Booking | Bookit <= 2.5.0 - Missing Authorization to Unauthenticated Stripe ConnectionEPSS 0.3%