Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-30
Booktics - Security Vulnerability (CVE-2026-62122)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
PLUGIN
Booktics
CVE-2026-62122
Risk Score
Threat Entry
Updated 2026-10-30
Booktics - Security Vulnerability (CVE-2026-104674)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.
PLUGIN
Booktics
CVE-2026-104674
Risk Score
Threat Entry
Updated 2026-10-07
Booktics - Security Vulnerability (CVE-2026-104390)
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
PLUGIN
Booktics
CVE-2026-104390
Risk Score
Threat Entry
Updated 2026-09-11
Booktics - Security Vulnerability (CVE-2026-62135)
Unauthenticated Broken Access Control in Booktics
PLUGIN
Booktics
CVE-2026-62135
Risk Score
Threat Entry
Updated 2026-09-11
Booktics - Security Vulnerability (CVE-2026-11446)
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address…
PLUGIN
Booktics
CVE-2026-11446
Risk Score
Threat Entry
Updated 2026-10-23
Booktics - SQL Injection (CVE-2026-28002)
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.
PLUGIN
Booktics
CVE-2026-28002
Risk Score
Threat Entry
Updated 2026-07-02
Booktics - PHP Object Injection (CVE-2026-57621)
Unauthenticated PHP Object Injection in Booktics
PLUGIN
Booktics
CVE-2026-57621
Risk Score
Threat Entry
Updated 2026-07-24
Booktics - Broken Access Control (CVE-2026-39585)
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
PLUGIN
Booktics
CVE-2026-39585
Risk Score
Threat Entry
Updated 2026-06-17
Booktics - Broken Access Control (CVE-2026-1920)
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
PLUGIN
Booktics
CVE-2026-1920
Risk Score
Threat Entry
Updated 2026-06-17
Booktics - Broken Access Control (CVE-2026-1919)
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
PLUGIN
Booktics
CVE-2026-1919
Risk Score