CVE-2026-62122

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-104674

WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-57621

WordPress Booktics plugin <= 1.0.21 - PHP Object Injection vulnerability

Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics Wordpress

CVE-2026-104390

WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-112829

WordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-109895

WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics Booktics booktics allows DOM-Based XSS.This issue affects Booktics: from n/a through 1.0.29.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-109894

WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-107418

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-108477

WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress-extensions

Products

Booktics Booktics

CVE-2026-62135

WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics Wordpress

CVE-2026-11446

Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics – Booking Calendar For Appointments And Service Businesses Wordpress

CVE-2026-28002

WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics Wordpress

CVE-2026-39585

WordPress Booktics plugin <= 1.0.16 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics Wordpress

CVE-2026-1920

Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics – Booking Calendar For Appointments And Service Businesses Wordpress

CVE-2026-1919

Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arraytics Wordpress

Products

Booktics – Booking Calendar For Appointments And Service Businesses Wordpress