CVE-2026-39585
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The Booktics WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.16.
Risk Assessment
An unauthorized user can access booking management functions or customer data, potentially leading to data leakage and privacy breach.
Recommendation
Update the Booktics plugin to the latest version and verify access control configuration.
Other vulnerabilities in Booktics
See all- CVE-2026-57621Critical
The Booktics plugin version 1.0.21 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object without authentication.
- CVE-2026-62135Medium
The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.
- CVE-2026-28002High
SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.
Original NVD description (English source)
Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS