Booktics EUVD-2026-97721

Exploitation requires the attacker to possess an authenticated account on the target WordPress site (PR:L), typically any low-privilege role such as subscriber or customer; the affected Booktics plugin (version through 1.0.28) must be installed and active. The flaw is a missing/incorrectly-configured access-control check (CWE-862) on plugin functionality, so no special non-default setting is named in the description - exploitation works against standard installs that permit user registration or that already have low-tier accounts. The primary limiting factor is the authentication requirement: fully unauthenticated visitors cannot exploit it, and impact is confined to limited data read/modification (C:L/I:L), with no availability effect and no user interaction needed.

This is a moderate, not high-priority, issue. The CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) describes a network-reachable, low-complexity missing-authorization flaw that nonetheless REQUIRES an authenticated low-privilege account (PR:L) and yields only limited confidentiality and integrity impact with no availability impact - consistent with a typical WordPress broken-access-control bug where a low-level user (e.g., subscriber/customer) can invoke actions reserved for higher roles. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. The CVE is NOT listed in CISA KEV and no public exploit code is referenced, so there is no evidence of active exploitation - the sole reference is a Patchstack advisory. The signals are internally consistent (no CVSS-vs-description conflict): network vector plus PR:L aligns with an authenticated WordPress REST/AJAX authorization gap. Overall this is a genuine but mid-severity authorization weakness whose real-world risk is bounded by the need for a valid account and the low technical impact, not a drop-everything critical.

An attacker who holds or registers a low-privilege account on a WordPress site running the Booktics plugin (through 1.0.28) sends a crafted request to a plugin endpoint whose authorization check is missing or misconfigured. Because the server does not verify the caller's role, the attacker reads or modifies booking data they should not be able to access. No public proof-of-concept is identified at time of analysis.