Patchstack published CVE-2026-62048 on 30 October 2026: an SQL injection in BookIt, the WordPress appointment and booking plugin maintained by Liquid Web and StellarWP, affecting releases up to and including 2.6.0.6.

What happened

The flaw is an SQL injection reachable without authentication. Patchstack scores it 9.3 and lists the required privilege as none, which means a request from an anonymous visitor is enough to run statements against the site's database. The plugin was reported on 22 October 2026 and patched in 2.6.0.7.

What that buys an attacker depends on the database user, which for most WordPress sites is the same account the site itself uses. User tables with password hashes, booking records with names, phone numbers and email addresses, and anything else in that schema are all in reach, and the injection is not limited to reading.

Who is affected

• Sites running BookIt 2.6.0.6 or earlier, whether or not the booking form is linked from the menu.
• Service businesses that take appointments online: clinics, salons, guesthouses, consultancies, training providers.
• Multisite installs where the plugin is network-activated, because one vulnerable copy covers every site in the network.
• Agencies and MSPs managing client WordPress sites built years ago and never audited since.

What to do now

Update BookIt to 2.6.0.7 or later today, then check whether the database was already touched.

• Update through the dashboard or WP-CLI, and confirm the version on the plugins screen afterwards.
• If the update cannot be applied now, deactivate the plugin; a booking form is not worth an exposed database.
• Rotate WordPress administrator passwords and the authentication salts in wp-config.php, since password hashes were reachable.
• List wp_users for accounts nobody created, and check the booking tables for rows or scripts that were not entered by staff.
• Add a temporary web application firewall rule that blocks SQL keywords on the booking endpoints until the update is confirmed everywhere.

What this means for South African businesses

Online booking is exactly what a small South African service business puts on the web, and the site is usually built once, handed over, and never looked at again, which is how a plugin ends up four years behind. Because WordPress keeps customer records in the same database as its own logins, one anonymous SQL injection turns a brochure site into a POPIA notification question. My judgement is that the risk here is not a defaced homepage but a quiet copy of the customer table, which nobody notices until the phishing starts using real booking references.

Source: Patchstack advisory for BookIt.

Also on the blog

• WatchGuard Fireware 2026.4 fixes 18 Firebox flaws, seven at 9.1 or higher
• GhostMap: one Android APK, no permissions, an endless reboot loop

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.