CVE-2026-1920 Booktics <= 1.0.16 - Missing Authorization to Addon Plugin Installation
MediumCVSS 5.3
EPSS 0.26%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Arraytics Booktics – Booking Calendar for Appointments and Service Businesses | <= 1.0.16 | No fix listed |
| wordpress booktics(WordPress) | < 1.0.17 | 1.0.17 |