# CVE-2026-62048: CVE-2026-62048

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Liquid Web / StellarWP BookIt bookit allows SQL Injection.This issue affects BookIt: from n/a through 2.6.0.6.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 3.1: 9.3 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L; source: NVD: audit@patchstack.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: exploitation none; automatable yes; technical impact partial; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0

- Weaknesses: CWE-89

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://patchstack.com/database/wordpress/plugin/bookit/vulnerability/wordpress-bookit-plugin-2-6-0-6-sql-injection-vulnerability?_s_id=cve (audit@patchstack.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-62048; retrieved 2026-11-02; source updated 2026-11-01

Revision: 7201356c0738671ecf706913945845527b670dd16db27ff7c3620fbee18b1c11

Canonical: https://y2.dev/cve/CVE-2026-62048