Bookit — Booking & Appointment Calendar
Bookit — Booking & Appointment Calendar has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 13 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 6 disclosures.
The most common weakness is Missing Authorization, behind 7 of the records (54%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Authentication Bypass Using An Alternate Path Or Channel.
Every one of the 13 issues recorded for Bookit — Booking & Appointment Calendar has a vendor fix available, so running the current release closes all known holes.
12 independent researchers contributed these findings, one record each. Bookit — Booking & Appointment Calendar is installed on roughly 4,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.
CVE-2023-2834BookIt <= 2.3.7 - Authentication Bypass
Read the full analysisVulnerability Records
Bookit — Booking & Appointment Calendar
Author
Nexcess
Bookit adds an appointment booking system and event calendar to your WordPress site. You define services, staff, working hours, and prices; visitors pick a date and time and submit a booking. The plugin prevents double-booking and sends configurable email notifications. What you can do: Define multiple services with duration and price; assign staff and set their working hours and days. Show availability in daily, weekly, or monthly calendar views. Place a booking form on any page via shortcode or with Elementor and WPBakery widgets. Let customers choose a service and staff, see available slots, and submit a booking (no account required unless you enable it). Receive and send email notifications for new, updated, or upcoming appointments; templates are editable in settings. Manage all appointments from the admin dashboard; optional Stripe payments in the free version. Optional BookIt Pro add-ons add WooCommerce integration, Google Calendar sync, drag-and-drop custom fields, and additional payment options (e.g. PayPal). Documentation and support are available at bookitwp.com.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C