Booktics CVE-2026-39585

Arraytics Booktics must be installed and activated on a WordPress site. The vulnerability exists in the plugin's access control implementation regardless of WordPress security hardening; however, exploitation requires the attacker to identify and reach endpoints that lack authorization checks. Standard WordPress configurations do not prevent this vulnerability if the plugin is present, but sites with strict WAF rules, IP whitelisting, or additional authentication layers may provide incidental protection. The vulnerability is accessible to unauthenticated remote users without any special plugin configuration or feature enablement required.

The CVSS 3.1 score of 5.3 (Medium) reflects a network-accessible attack with no authentication required, low complexity, and integrity impact (data modification) without confidentiality or availability impact. However, the EPSS score of 0.02% (percentile 4) is notably low, suggesting minimal real-world exploitation activity and a gap between theoretical attack surface and practical threat. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) confirms unauthenticated remote exploitation is feasible, but the absence of POC code, KEV status, or reported active exploitation indicates this remains a theoretical vulnerability. For organizations using Booktics, the risk is contingent on whether the plugin is exposed to untrusted users and whether the misconfigured endpoints handle sensitive booking data; for most deployments where Booktics is used on trusted sites with standard WordPress security, the practical risk is moderate to low.

An unauthenticated attacker discovers a publicly exposed WordPress site using Booktics and identifies that plugin endpoints handling booking creation, modification, or deletion do not verify user authorization. The attacker crafts a direct HTTP POST request to /wp-admin/admin-ajax.php with Booktics-specific action parameters, bypassing the missing authorization check to add, modify, or delete booking records without logging in. While this could disrupt legitimate bookings or inject false data, the low EPSS score suggests this vector is rarely exploited in the wild, possibly due to plugin obscurity or limited incentive for attackers.