The Bookit plugin for WordPress contains an authorization bypass vulnerability that allows unauthenticated attackers to hijack payment configurations, posing a significant financial and operational risk.

The plugin fails to perform a proper capability check on the /wp-json/bookit/v1/commerce/stripe/return REST API endpoint. This oversight permits unauthenticated attackers to connect their own Stripe accounts to the victim's site and intercept incoming payments.

Successful exploitation of this vulnerability can result in the diversion of business revenue to attacker-controlled accounts. Given the CVSS score of 7.5, this high-severity flaw represents a major risk to financial integrity and customer trust, as attackers can gain full control over the payment processing flow without requiring administrative privileges.

Immediate Action: Since a specific patched version is not currently identified, administrators should immediately deactivate the Bookit plugin until a secure update is released by StellarWP.

Proactive Monitoring: Security teams should monitor web server access logs for suspicious requests directed at the /wp-json/bookit/v1/commerce/stripe/return endpoint.

Compensating Controls: Deploy a Web Application Firewall rule to block access to the affected REST API endpoint from unauthorized IP addresses or to restrict access to the plugin directory entirely until remediation is complete.

Public Exploit Available: No (exploit_available: false)

This vulnerability presents a critical threat to the financial operations of any organization utilizing the Bookit plugin. Because the flaw allows for unauthenticated modification of payment endpoints, it is imperative that administrators take immediate action to neutralize the risk by deactivating the affected software. Monitor vendor communications closely for the release of a security patch and perform a thorough audit of payment gateway configurations to ensure no unauthorized accounts have been linked.