Vulnerabilidades do Arraytics Booktics – Booking Calendar for Appointments and Service Businesses
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Arraytics Booktics – Booking Calendar for Appointments and Service Businesses: 2 registro(s), com versões afetadas e correções.
CVE-2026-1920
Média · 5.3
CWE-306 10/03/2026
Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
CVE-2026-1919
Média · 5.3
CWE-306 10/03/2026
Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.