CVE-2026-57621
CriticalCVSS 9.8Summary
The Booktics plugin version 1.0.21 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object without authentication.
Risk Assessment
The risk includes remote code execution, which can lead to full server compromise, data theft, or further attack propagation within the organization's network.
Recommendation
Immediately update the Booktics plugin to the latest available version that fixes this vulnerability. If an update is not possible, consider temporarily disabling the plugin.
Other vulnerabilities in Booktics
See all- CVE-2026-62135Medium
The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.
- CVE-2026-28002High
SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.
- CVE-2026-39585Medium
The Booktics WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.16.
Original NVD description (English source)
Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS