Booktics CVE-2026-109894

Requires the Arraytics Booktics plugin to be installed and active on a WordPress site at any version from the initial release through 1.0.29, and the attacker must reach the specific plugin request handler that passes user input into an SQL query. The advisory does not name the exact vulnerable parameter or endpoint, so the concrete injectable input is not identified in the available data. The CVSS vector asserts no authentication (PR:N) and no user interaction, but authentication requirements are not confirmed from the description text alone; defenders should verify with the vendor whether a login (e.g. subscriber-level) is actually needed, as this materially changes exposure. Limiting factors: the niche plugin must be present, and only sites running vulnerable versions are affected.

This is a network-exploitable SQL injection (CWE-89) in the Booktics WordPress plugin, scored CVSS 9.3 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L - low attack complexity, no privileges, no user interaction, and a changed scope reaching the backend database. On raw CVSS this reads as a high-priority issue. However, the corroborating exploitation signals are weak or absent: no EPSS score was provided, the CVE is NOT in CISA KEV, and no public proof-of-concept is referenced - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The only intelligence source is a single Patchstack advisory (the reporter), with no NVD-enriched CPE, no vendor advisory, and no independent confirmation of affected version boundaries beyond 'n/a through 1.0.29'. The vector claims PR:N (unauthenticated), but Patchstack-class WordPress plugin SQLi findings frequently require at least a low-privilege authenticated session, and the description contains no auth detail to confirm PR:N - treat the unauthenticated claim as vendor-asserted, not independently verified. Net assessment: a genuinely serious code-level flaw whose real-world risk is tempered by a niche product footprint and the absence of any exploitation or POC signal, so this is a patch-promptly item rather than an emergency on the scale the 9.3 alone would imply.

A remote attacker sends a crafted HTTP request to a vulnerable Booktics plugin endpoint (e.g. a booking or query parameter) that is passed unsanitized into an SQL statement, injecting attacker-controlled SQL. Given AV:N/AC:L, this requires only network reachability to the WordPress site and no special timing or user interaction, allowing extraction of database contents such as user records and WordPress secrets. No public proof-of-concept is referenced, so exploitation would require the attacker to independently identify the injectable parameter.