Booktics CVE-2026-108477

Exploitation requires only that the target WordPress site run the Booktics plugin at version 1.0.28 or earlier with the vulnerable access-control-missing endpoint reachable - no authentication, no user interaction, and no special non-default configuration is indicated by the CVSS vector (AV:N/AC:L/PR:N/UI:N). The CWE-862 nature and 'Incorrectly Configured Access Control Security Levels' wording suggest a specific plugin action/endpoint lacks a capability or nonce check; the precise feature is not named in the available data. Realistic limiting factors are the plugin's low deployment footprint and the capped integrity-only impact (C:N/A:N), which bounds damage to unauthorized data modification rather than disclosure or denial of service.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Booktics WordPress plugin, rated CVSS 5.3. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates a network-reachable, low-complexity issue requiring no privileges or user interaction, but with impact limited to integrity only (I:L) - no confidentiality or availability consequences. The low integrity impact and absence of C/A impact mean an attacker can likely perform unauthorized modifications of a limited subset of data via an access-control-missing endpoint, not full compromise. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no public exploit code is referenced, so there is no evidence of active exploitation. Signals are internally consistent (network/unauth broken access control is plausible for the stated CWE) and point to a real but lower-tier priority rather than an emergency: the broad reachability (unauthenticated, network) argues for timely patching, while the capped integrity-only impact and lack of exploitation signals argue against treating it as critical. Key missing data: no EPSS, no SSVC decision data, and the description is generic ('Incorrectly Configured Access Control Security Levels') without naming the specific vulnerable function or action.

An unauthenticated attacker sends a crafted HTTP request directly to a Booktics plugin endpoint (e.g., an AJAX or REST action) that fails to verify the caller's authorization, allowing them to invoke a restricted operation and modify booking-related data they should not be able to change. Because no authentication or user interaction is required, the request can be issued remotely against any site running an affected version. No public proof-of-concept is referenced at the time of analysis.