Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.28 - Unauthenticated Missing Authorization to Google Calendar Token Overwrite via OAuth Callback
- ID
- WPSEC-2026-0786
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- from 1.0.4 before 1.0.29
- Remediation
- Update to 1.0.29 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-12
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data via the Google Calendar OAuth callback in versions 1.0.4 up to, and including, 1.0.28. This is due to the handle_google_auth_callback() function, which runs on template_redirect for every front-end request, having no authentication or capability check and trusting a 'state' parameter that is only base64-encoded JSON naming the target 'team_member_id'. This makes it possible for unauthenticated attackers who know the site's Google OAuth client ID (which any logged-in user can get from the plugin's connect endpoint) to submit an authorization code for their own Google account and overwrite the stored Google Calendar tokens of any user, including administrators and team members. The same request also works as a forged link opened by a logged-in user. Afterwards, that user's bookings may be synced to the attacker's Google Calendar, and the attacker's calendar events may block booking slots.
References
- https://wpsec.com/vuln/WPSEC-2026-0786/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.29/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS