CVE-2026-62135
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The Booktics plugin in versions up to and including 1.0.24 contains a Broken Access Control vulnerability exploitable by an unauthenticated attacker. This allows operations beyond granted permissions.
Risk Assessment
An unauthenticated attacker can bypass access control mechanisms, potentially leading to unauthorized access to booking system functions or data.
Recommendation
Update the Booktics plugin to a version newer than 1.0.24 as soon as a fix becomes available.
Other vulnerabilities in Booktics
See all- CVE-2026-57621Critical
The Booktics plugin version 1.0.21 and earlier contains an unauthenticated PHP Object Injection vulnerability. An attacker can remotely inject a malicious PHP object without authentication.
- CVE-2026-28002High
SQL Injection vulnerability in Booktics (Arraytics) versions up to 1.0.22. Allows blind SQL injection.
- CVE-2026-39585Medium
The Booktics WordPress plugin has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This issue affects versions up to and including 1.0.16.
Original NVD description (English source)
Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS