Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Missing Authorization via Notification Flow REST Routes
- ID
- WPSEC-2026-1026
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- all versions before 1.0.30
- Remediation
- Update to 1.0.30 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.0.29. This is due to the notification-flow REST routes of the bundled email notification library being registered with a permission callback that always returns true, combined with a sanitizer that skipped HTML filtering for any value containing an SVG element. This makes it possible for unauthenticated attackers to read, create, modify, clone and delete the notification flows that control the emails the site sends, and to store arbitrary web scripts in flow content that execute when an administrator opens the flow in the editor.
References
- https://wpsec.com/vuln/WPSEC-2026-1026/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.30/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS