{
 "id": "WPSEC-2026-1026",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1026/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1026/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1026/index.md",
 "title": "Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Missing Authorization via Notification Flow REST Routes",
 "description": "The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.0.29. This is due to the notification-flow REST routes of the bundled email notification library being registered with a permission callback that always returns true, combined with a sanitizer that skipped HTML filtering for any value containing an SVG element. This makes it possible for unauthenticated attackers to read, create, modify, clone and delete the notification flows that control the emails the site sends, and to store arbitrary web scripts in flow content that execute when an administrator opens the flow in the editor.",
 "plugin": {
  "slug": "booktics",
  "name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "full_name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "wordpress_org": "https://wordpress.org/plugins/booktics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booktics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booktics"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.30",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.30"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.30",
 "remediation": "Update to 1.0.30 or later.",
 "fix_released": "2026-10-14T12:55:31+00:00",
 "published": "2026-10-15T13:50:16+00:00",
 "updated": "2026-10-14T19:51:34.785526+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1026/",
  "https://plugins.svn.wordpress.org/booktics/tags/1.0.30/",
  "https://wordpress.org/plugins/booktics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booktics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}