CVE-2026-89007 - Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

Back Back to CVE browser

LOW

Bookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization

Published Sep 18, 2026

2.7

LOW

CVSS 3.1

EPSS 0.28%

Description

The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, allowing users with its low-privileged custom Staff role to delete arbitrary appointments.

Affected products

Vendor n/a Product Bookit — Booking & Appointment Calendar Default
unaffected
Affected
- ≥ 0, < 2.6.0.5

Default status is the baseline for the product. Each version can override it (patched versions can be marked unaffected).

Vendor	Product	Default status	Versions
n/a	Bookit — Booking & Appointment Calendar	unaffected	Affected ≥ 0, < 2.6.0.5

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-862

Missing Authorization

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82680
Advisory
https://wpscan.com/vulnerability/5e174229-a375-456c-b651-7ad4a3c004ab/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-82680		Advisory
https://wpscan.com/vulnerability/5e174229-a375-456c-b651-7ad4a3c004ab/		exploitvdb-entrytechnical-description

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Sep 18, 2026

Updated Sep 18, 2026

Reserved Sep 10, 2026

Link CVE-2026-89007

CISA Vulnrichment

Updated Sep 18, 2026

NVD

Status Deferred

Modified Sep 18, 2026

Link CVE-2026-89007

Red Hat

No data

ENISA EUVD

Assigner WPScan

Published Sep 18, 2026

Updated Sep 18, 2026

Link EUVD-2026-82680

GitHub

No data