Booktics EUVD-2026-57917

Exploitation requires a valid WordPress user account with at minimum subscriber-level (low-privilege) access, confirmed by the PR:L CVSS metric - sites with disabled public registration are meaningfully harder to attack. The target must be running Booktics plugin version 1.0.22 or earlier and the plugin must be active. No special server-side configuration, non-default settings, or specific operating mode is required beyond plugin activation, given AC:L. Exploitation is limited by the blind injection technique, which requires multiple sequential requests and is slower than error-based or union-based injection, making large-scale automated scanning less likely but targeted extraction fully feasible. No user interaction is required once authentication is achieved.

The CVSS 8.5 score is driven primarily by the Scope:Changed component, which amplifies the rating beyond the plugin's isolated footprint. The PR:L metric confirms exploitation requires a low-privileged authenticated WordPress account - a meaningful but not significant barrier on sites with open registration or shared credentials. AC:L indicates no race conditions or special timing is required. No EPSS data was provided in the intelligence sources, and no KEV listing exists, so real-world exploitation probability cannot be quantified beyond the structural CVSS signals. The absence of a known POC reduces immediate opportunistic risk, though the SQL injection class is well-understood and tooling such as sqlmap trivially automates blind injection extraction once an endpoint is identified - even a small organization running an unpatched Booktics instance should not treat the missing POC as a reliable safety net. The High confidentiality and Low availability impacts align with typical blind read-only SQLi behavior. Integrity impact is rated None in the provided vector, suggesting the injection path does not permit data modification, though this should be verified against the full Patchstack advisory.

An attacker registers or obtains a low-privileged WordPress account on a target site running Booktics 1.0.22 or earlier, then submits crafted HTTP requests to a vulnerable plugin endpoint with SQL payloads embedded in input fields. Using boolean-based blind injection, the attacker iterates character-by-character through database contents - extracting WordPress user password hashes, email addresses, and potentially API keys or plugin configuration secrets stored in the database. No public POC has been identified, but the technique is automatable with standard tooling once the injectable parameter is located.