Booktics CVE-2026-62135

No special conditions are required beyond network access to a WordPress site running Booktics version 1.0.24 or earlier - the CVSS vector PR:N/AC:L/UI:N confirms unauthenticated exploitation over the network against default plugin configurations. The limiting factor is that the integrity impact is low (I:L) and scope is unchanged (S:U), meaning exploitation cannot escalate to RCE or data theft based on available data. Exploitation is restricted to WordPress sites with the Booktics plugin installed and active; sites not using this plugin are unaffected.

CVSS 5.3 Medium reflects a realistic assessment: the attack is trivially launched over the network with no credentials (AV:N/AC:L/PR:N/UI:N), but impact is limited to low integrity modification (I:L) with no confidentiality or availability consequence (C:N/A:N, S:U). EPSS data is absent from provided inputs, but broken access control in low-traffic niche booking plugins typically yields low opportunistic exploitation rates. No KEV listing and no POC code exist, further reducing urgency. The primary real-world risk is unauthorized manipulation of booking records, possibly allowing attackers to cancel, create, or alter reservations without authentication - a meaningful business impact for active booking deployments even if not system-compromising. SSVC assessment would likely land at 'Track' rather than immediate remediation, given no active exploitation and limited blast radius.

An unauthenticated attacker sends a crafted HTTP POST request directly to the WordPress site's admin-ajax.php or REST API endpoint exposed by Booktics, triggering an unprotected action that modifies booking records. No credentials, tokens, or prior access are required, and the low attack complexity means this could be scripted trivially. No public exploit code is currently known, but the straightforward nature of missing-authorization flaws means exploitation requires minimal skill.