Booktics EUVD-2026-114268

Exploitation requires a target WordPress site running the Booktics plugin version 1.0.31 or earlier, where an access-control check on a plugin action is missing or incorrectly configured. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so any network-reachable installation is a candidate. The specific endpoint, action, or configuration that exposes the flaw is not described in the available sources; the main limiting factors are the low integrity-only impact (no data disclosure or availability loss) and the relatively narrow deployment footprint of this plugin.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Booktics WordPress plugin, scored CVSS 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). The vector indicates network-reachable, low-complexity exploitation with no privileges or user interaction, but impact is limited to a low integrity effect only (C:N/I:L/A:N), meaning an attacker can likely invoke a protected action or alter some data without authentication, not read sensitive data or affect availability. The vuln.today decision label is 'this_month' (not act_now/emergency), consistent with a real but non-critical priority. There is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or widespread exploitation; the only reference is a Patchstack advisory, which is a vulnerability database entry rather than confirmed working exploit code. Net: a legitimate issue to patch on a normal cadence, not a drop-everything emergency - the unauthenticated network vector raises attention, but the low single-impact ceiling and absence of KEV/EPSS/PoC-exploit evidence keep real-world risk moderate. Note the exact protected feature affected is not described in the available sources.

An unauthenticated remote attacker sends a crafted request directly to a Booktics plugin endpoint whose access-control check is missing or misconfigured, invoking functionality or modifying data that should require authorization. Because no authentication or user interaction is needed, this can be scripted against exposed WordPress sites, though the concrete action affected is not described in the available sources. No working public exploit is identified; a Patchstack advisory reference exists but is not verified as working exploit code.