Booktics
Monthly
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Booktics WordPress plugin through 1.0.31 contains a missing-authorization condition that allows authenticated low-privilege users to read data they should not be able to access. The issue is rated CVSS 4.3 with PR:L and only confidentiality impact, and no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an emergency, with exposure concentrated on sites that permit subscriber or customer accounts.
Missing authorization in the Arraytics Booktics WordPress plugin (all versions through 1.0.31) lets unauthenticated remote attackers invoke a plugin action that should be gated behind an access-control check, with integrity-only impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) indicates no credentials or user interaction are required, but the flaw permits only limited modification of data - no disclosure of information and no loss of availability. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assessed priority is 'this_month', and the practical exposure is bounded by the plugin's relatively narrow deployment footprint.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.
Blind SQL injection in the Booktics WordPress plugin (all versions through 1.0.22) enables authenticated low-privileged network attackers to systematically extract data from the underlying database. The CVSS Scope:Changed metric indicates data exposure extends beyond the plugin's own tables to the broader WordPress database, yielding a High confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network accessibility make this a meaningful risk for any WordPress site running an affected version.
Unauthenticated PHP Object Injection in the Booktics WordPress plugin (by Arraytics) affects all versions up to and including 1.0.21, letting remote attackers with no authentication inject arbitrary PHP objects into the application. If a suitable POP (property-oriented programming) gadget chain exists in the plugin, WordPress core, or another active plugin, this can escalate to remote code execution, data theft, or full site takeover. Reported by Patchstack and rated CVSS 9.8; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Booktics WordPress plugin through 1.0.31 contains a missing-authorization condition that allows authenticated low-privilege users to read data they should not be able to access. The issue is rated CVSS 4.3 with PR:L and only confidentiality impact, and no public exploit was identified at time of analysis. This is a moderate-severity, low-priority issue rather than an emergency, with exposure concentrated on sites that permit subscriber or customer accounts.
Missing authorization in the Arraytics Booktics WordPress plugin (all versions through 1.0.31) lets unauthenticated remote attackers invoke a plugin action that should be gated behind an access-control check, with integrity-only impact. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) indicates no credentials or user interaction are required, but the flaw permits only limited modification of data - no disclosure of information and no loss of availability. No public exploit has been identified at time of analysis and the issue is not in CISA KEV; the assessed priority is 'this_month', and the practical exposure is bounded by the plugin's relatively narrow deployment footprint.
Missing authorization in Arraytics Booktics through 1.0.30 lets unauthenticated remote attackers reach a plugin endpoint that should be access-controlled, exposing limited data (CVSS 5.3). The issue is CWE-862 and affects WordPress sites with the plugin active; no public exploit identified at time of analysis.
Missing authorization in the Arraytics Booktics WordPress plugin (versions through 1.0.28) lets an authenticated low-privilege user - such as a subscriber or customer - invoke plugin functionality that should be reserved for higher-privileged roles, resulting in limited unauthorized data disclosure and modification. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N, score 5.4) confirms the attack is network-reachable and requires no user interaction, but an account on the target site is a hard prerequisite, and there is no availability impact. No public exploit code has been identified at time of analysis, and this is assessed as a moderate, not high-priority, issue.
Missing authorization checks in the Arraytics Booktics WordPress plugin through version 1.0.28 let unauthenticated remote attackers invoke functionality that should require elevated privileges, resulting in a limited integrity-only impact (CVSS 5.3, CWE-862). Because the CVSS vector is PR:N/UI:N, exploitation needs only network reachability of the vulnerable endpoint on a site running the plugin - no account, no victim interaction, and no non-default configuration. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low attack complexity makes the flaw attractive to automated WordPress scanning and mass-exploitation tooling; risk is tempered by the plugin's small deployment footprint and the fact that confidentiality and availability are unaffected.
Missing authorization in the Booktics WordPress plugin (versions up to and including 1.0.27) allows authenticated low-privilege users to access restricted data, resulting in limited confidentiality exposure. The flaw requires a valid account on the target site but no administrative rights and no user interaction, affecting only sites with the plugin installed and activated. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the CVSS score is 4.3 (moderate).
Broken access control in the Booktics WordPress plugin (by Arraytics) through version 1.0.24 permits unauthenticated remote attackers to perform restricted write operations without any authentication. The CVSS vector (PR:N, I:L) confirms the flaw allows unauthorized integrity-impacting actions - such as modifying booking data or plugin state - accessible directly over the network. No public exploit code or active exploitation has been identified at time of analysis.
Missing authorization in Arraytics Booktics WordPress plugin through version 1.0.16 allows unauthenticated remote attackers to modify application data via incorrectly configured access control security levels. The vulnerability has a low EPSS score (0.02%, percentile 4) despite the network-accessible attack vector, suggesting limited real-world exploitation likelihood. No public exploit code or active CISA KEV status has been identified.