Arraytics Booktics – Booking Calendar for Appointments and Service Businesses vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Arraytics Booktics – Booking Calendar for Appointments and Service Businesses: 2 record(s), with affected versions and fixes.
CVE-2026-1920
Medium · 5.3
CWE-306 Mar 10, 2026
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
CVE-2026-1919
Medium · 5.3
CWE-306 Mar 10, 2026
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.