Booktics EUVD-2026-114275

Exploitation requires the attacker to hold a valid authenticated account on the target WordPress site, because the CVSS vector specifies PR:L - the flaw is reachable only after login as a low-privilege user (e.g., subscriber or customer). The affected component is the Arraytics Booktics plugin at versions through 1.0.31; sites not running this plugin, or running a fixed version, are not affected. The specific endpoint, parameter, or feature whose access control is missing is not detailed in the available sources, so the exact trigger is not described beyond the CWE-862 missing-authorization classification. The principal limiting factor is the authentication requirement: exploitation is not possible for fully unauthenticated visitors, which meaningfully constrains real-world risk on sites that do not allow open user registration.

This is a moderate-severity, low-priority issue rather than an emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, base 4.3) indicates a network-reachable flaw that is easy to execute but requires an already-authenticated low-privilege account (PR:L), with only limited confidentiality impact and no integrity or availability impact. The vuln.today decision label is 'this_month', which aligns with a non-urgent but worth-patching posture. No CISA KEV listing is present, so there is no confirmed active exploitation, and no EPSS score was supplied, so exploitation probability cannot be quantified from this data. The sole reference is a Patchstack vulnerability database entry, not a verified working exploit, so there is no evidence of public exploit code. The signals are internally consistent - a low-privilege, low-impact broken-access-control bug in a niche WordPress booking plugin - pointing to real but limited risk concentrated on sites that grant low-trust user accounts. EPSS and KEV data are both absent; their absence is not itself an error but means real-world exploitation likelihood is unverified.

An attacker who already holds a low-privilege authenticated account on a WordPress site running Booktics (through 1.0.31) sends a request to a plugin endpoint whose access-control check is missing or misconfigured, reaching functionality or data intended for higher-privileged users. The result is limited information disclosure (CVSS C:L). No public exploit code is confirmed; the only reference is a Patchstack database entry.