EUVD-2026-57917
GHSA-98f9-c7mv-fphv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L
Network-accessible blind SQLi requiring low-privilege authentication; scope change justified by cross-table database access; no integrity impact confirmed from available description.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.
This issue affects Booktics: from n/a through 1.0.22.
AnalysisAI
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
Technical ContextAI
The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command), indicating that user-supplied input is incorporated into SQL queries without adequate sanitization or parameterization. The blind variant means query results are not directly returned to the attacker; instead, data is inferred through boolean-based (true/false response differences) or time-based (deliberate server delays) side channels, requiring more attacker effort but still fully exploitable. The affected component is the Arraytics Booktics plugin for WordPress, identified by CPE cpe:2.3:a:arraytics:booktics:*:*:*:*:*:*:*:*. WordPress plugins execute in the context of the shared WordPress database connection, which explains the Scope:Changed rating - a plugin-level injection can reach credentials, user PII, and configuration data stored in core WordPress tables.
RemediationAI
The primary remediation is to update the Booktics plugin beyond version 1.0.22; however, no exact fixed version number was confirmed in the available intelligence sources - administrators should consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-22-sql-injection-vulnerability?_s_id=cve and the WordPress plugin repository for the latest patched release. If an update is unavailable or cannot be applied immediately, a viable compensating control is to restrict WordPress registration and remove or demote any untrusted low-privilege accounts, since PR:L means exploitation requires authenticated access - this directly removes the attacker's foothold without disabling the plugin entirely. Additionally, a web application firewall (WAF) rule targeting SQL metacharacter patterns in plugin-specific POST parameters can detect and block blind injection probes, though WAF bypass is possible against determined attackers. Deactivating the plugin until a patch is confirmed is the safest interim option if booking functionality is non-critical.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and incl
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attack
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated rem
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today