Booktics CVE-2026-104390

Exploitation requires an authenticated account on the target WordPress site at low privilege level (CVSS PR:L) - the flaw is a missing authorization check (CWE-862) in the Booktics plugin, so the attacker must be able to reach the plugin's endpoints as a logged-in user but does not need administrative rights. Exploitation is limited to sites that actually have the Booktics plugin installed and activated (versions up to and including 1.0.27), and to attackers who can obtain any valid low-privilege account; no user interaction by a victim is required (UI:N). The impact is bounded to limited confidentiality exposure (C:L), with no integrity or availability effect.

This is a moderate-to-low priority issue despite being network-exploitable. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, score 4.3) indicates a network-reachable flaw with low attack complexity requiring low-privilege authentication (PR:L), with only limited confidentiality impact and no integrity or availability impact. CISA's SSVC framework reinforces the low-urgency reading: Exploitation=none (no observed or public exploitation), Automatable=no, and Technical Impact=partial. There is no CISA KEV listing and no public POC identified in the provided data, and no EPSS score was supplied. All signals are consistent and point in the same direction - a genuine but low-severity broken-access-control bug rather than an urgent threat. The limiting factor is the PR:L requirement: an attacker needs at least a low-privileged authenticated account on the target WordPress site, which constrains mass exploitation. Note that EPSS data is absent from the input and cannot be weighed.

An attacker who holds a low-privileged authenticated account (for example a subscriber-level user) on a WordPress site running the Booktics plugin sends a request to a plugin endpoint that fails to verify proper authorization, allowing them to read booking-related data or perform actions they should not be permitted to. No public exploit code was identified at the time of analysis, and the limited (low) confidentiality impact means the exposure is bounded rather than full compromise.