CVE-2023-2834: stellarwp bookit — booking & appointment calendar
Vulnerability summary
CVE-2023-2834 is a critical (CVSS 9.8) vulnerability in stellarwp bookit — booking & appointment calendar. EPSS estimates a 1.91% chance of exploitation in the next 30 days, higher than 79.5% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 2.3.8.
Timeline
- 30-06-2023PublishedVulnerability first disclosed.
- 08-04-2026Last modifiedVulnerability information updated.
Description
The BookIt plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.3.7. This is due to insufficient verification on the user being supplied during booking an appointment through the plugin. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- wordfenceSource9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
1.91%
Chance of exploitation in the next 30 days
Percentile
80%
Versus all other CVEs
30-day change
0.00 pp
From 1.91% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (wordfence.com)
Maturity: unknown
Exploit Reference (lana.codes)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
- CWE-288Authentication Bypass Using an Alternate Path or ChannelThe product requires authentication, but the product has an alternate path or channel that does not require authentication.
Affected systems
Stellarwp1 product
Stylemixthemes1 product
- bookit≤ 2.3.7
Wordpress1 product
- bookit≤ 2.3.7 (fixed in 2.3.8)
3 vendors · 3 products