CVE-2026-104674
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Arraytics Booktics plugin in versions up to 1.0.31 contains a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. The issue affects all versions from the start through 1.0.31.
Risk Assessment
An attacker may exploit improperly configured access control to reach functions or data they are not authorized to access. This could lead to unauthorized operations within the booking system.
Recommendation
Update the Booktics plugin to a version newer than 1.0.31. Review and correct the permission and access control configuration in the application.
Other vulnerabilities in Booktics
See all- CVE-2026-112829Medium
The WordPress Booktics plugin through 1.0.30 contains a Missing Authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This may allow unauthorized users to perform restricted actions.
- CVE-2026-109894Critical
The Booktics plugin (up to version 1.0.29) is vulnerable to SQL injection due to improper neutralization of special elements in SQL commands. An attacker can execute arbitrary SQL queries.
- CVE-2026-57621Critical
The Booktics plugin version 1.0.21 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object without authentication.
- CVE-2026-62122Medium
The Booktics plugin (Arraytics) through 1.0.31 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
- CVE-2026-109895High
The Booktics plugin (up to version 1.0.29) is vulnerable to DOM-Based XSS due to improper neutralization of input during web page generation. An attacker can inject a malicious script that gets executed in the victim's browser.
- CVE-2026-107418Medium
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- CVE-2026-108477Medium
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- CVE-2026-104390Medium
The Booktics plugin for WordPress has a missing authorization vulnerability that allows exploitation of incorrectly configured access control security levels. This issue affects versions from n/a through 1.0.27.
- CVE-2026-62135Medium
The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.
- CVE-2026-28002High
SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.
Original NVD description (English source)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS