CVE-2026-40780: WordPress BookIt plugin < 2.5.4.1 - Broken Authentication vulnerability

Synopsis

Authentication bypass in the WordPress BookIt plugin (versions before 2.5.4.1) allows an unauthenticated attacker to exploit the password recovery flow over the network, bypassing normal credential checks entirely. No login or user interaction is required; the attacker reaches the vulnerable endpoint directly via HTTP. Successful exploitation gives the attacker the ability to take over user accounts by resetting passwords without authorization. A patched-image rebuild at version 2.5.4.1 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable password recovery endpoint is exposed over the network, so the attacker must be able to send HTTP requests to the target WordPress instance.

• AuthenticationNot required

  No account or credential of any kind is needed; the vulnerability exists in the unauthenticated password recovery flow.

• Victim interactionNot required

  The attacker exploits the endpoint directly and does not need any user to click a link or take any action.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special conditions, race timing, or knowledge of the target environment.

Blast Radius

• The attacker can reset the password of any user account whose recovery flow is reachable, including administrator accounts, effectively taking full control of those accounts.
• With account control, the attacker can modify site content, install or alter WordPress plugins and themes, and change user roles or permissions.
• Sensitive data accessible to the compromised account, such as customer booking records and contact details stored in BookIt, becomes readable and exportable by the attacker.