This vulnerability (CWE-288) in Liquid Web / StellarWP BookIt involves an authentication bypass via an alternate path or channel, specifically impacting the password recovery process. The flaw allows attackers to circumvent normal authentication controls, potentially enabling unauthorized access or actions. The CVSS 3.1 score of 7.5 reflects high severity due to its network accessibility and lack of required privileges or user interaction. The issue affects versions prior to 2.5.4.1, but exact affected versions are not enumerated. No vendor advisory or patch information is currently available, and the product is not a cloud service, so remediation responsibility lies with the user.

Successful exploitation could allow an attacker to bypass authentication mechanisms in the BookIt application, specifically through the password recovery feature, leading to unauthorized actions or account compromise. The impact is high on integrity but does not affect confidentiality or availability according to the CVSS vector. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the password recovery functionality or implementing additional monitoring around authentication attempts if feasible.