CVE-2026-62135

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

EUVD-2026-76202

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

CVE-2026-62135

CVE-2026-62135 affects the WordPress Booktics plugin in versions ≤ 1.0.24 , introducing an unauthenticated Broken Access Control vulnerability. The flaw allows remote attackers with no prior access to modify data on the target site, resulting in a low integrity impact (CVSS 3.1: 5.3 MEDIUM , vect...

CVE-2026-62135 WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

EUVD-2026-75936

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-11446 Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-11446

The Booktics – Booking Calendar for Appointments and Service Businesses WordPress plugin (≤ 1.0.23) is vulnerable to unauthorized data modification due to a missing authorization check. The create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route unconditionally retur...

CVE-2026-11446: Missing Authorization

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the createorderpermission permission callback on the POST /wp-json/booktics/v1/orders REST...

PT-2026-89745

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create order permission permission callback on the POST /wp-json/booktics/v1/orders REST...

CVE-2026-62135: Missing Authorization

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

PT-2026-90033

Unauthenticated Broken Access Control in Booktics = 1.0.24 versions...

WordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Supakiad S. m3ez in WordPress Plugin Booktics versions = 1.0.24...

WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin <= 1.0.23 - Missing Authorization vulnerability

WordPress Booktics - Booking Calendar for Appointments and Service Businesses plugin = 1.0.23 - Missing Authorization vulnerability discovered by revblock in WordPress Plugin Booktics versions = 1.0.23...

CVE-2026-28002

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28002 WordPress Booktics plugin 1.0.22 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

EUVD-2026-57917

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22...

CVE-2026-28002

CVE-2026-28002 affects the WordPress Booktics plugin up to version 1.0.22. The issue is an SQL Injection (blind) caused by improper neutralization of special elements in SQL commands, enabling potential unauthorized data access. No exploitation details or patches are provided in the documents; re...