Booktics EUVD-2026-105138

Exploitation requires only that a vulnerable Booktics plugin version (from n/a through 1.0.30) be installed and active on an internet-reachable WordPress site; per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication, no user interaction, and no special non-default configuration are required to reach the flawed authorization check. The description frames this as 'Incorrectly Configured Access Control Security Levels,' so the missing check applies to a specific plugin endpoint/action rather than the whole site. The principal limiting factors are the plugin's modest deployment footprint and the restricted impact (read-only, low confidentiality, no integrity or availability effect), meaning a successful request discloses or triggers a single restricted resource rather than granting broader compromise.

The provided CVSS 3.1 base score is 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, indicating a network-reachable, low-complexity, unauthenticated flaw with only low confidentiality impact and no integrity or availability impact - consistent with a Missing Authorization (CWE-862) issue that exposes data or an action that should be access-controlled. No EPSS score, CISA KEV listing, or public exploit (POC) indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the signals do not conflict so much as they are sparse. Weighing these together, this is a genuine but modest-priority issue: the unauthenticated network vector (PR:N) makes it easy to reach, but the limited scope (C:L only, no write/integrity or availability consequence) caps real-world severity, and the affected product is a niche WordPress plugin rather than ubiquitous infrastructure. No SSVC decision data was provided. Treat as a routine-patch item rather than an emergency unless the exposed data is sensitive in a given deployment; verify the exact nature of the exposed resource with the Patchstack advisory, as 'low confidentiality impact' could range from minor metadata to booking/customer details.

An unauthenticated remote attacker sends a crafted HTTP request to a Booktics plugin endpoint that fails to enforce an authorization check, retrieving data or invoking functionality intended to be restricted. Because no user interaction or credentials are required (AV:N/PR:N/UI:N) and complexity is low, the request can be issued directly against any WordPress site running a vulnerable version (through 1.0.30). No public exploit code was identified in the provided data.