CVE-2026-39585

MediumCVSS 5.3

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

9th percentile - higher than 9% of all known CVEs

Summary

The Booktics WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.16.

Risk Assessment

An unauthorized user can access booking management functions or customer data, potentially leading to data leakage and privacy breach.

Recommendation

Update the Booktics plugin to the latest version and verify access control configuration.

Original NVD description (English source)

Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.