# Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.29 - Unauthenticated Missing Authorization via Notification Flow REST Routes

- **ID:** WPSEC-2026-1026
- **Plugin:** Booktics – Appointment Booking Calendar for Service Businesses (`booktics`), https://wordpress.org/plugins/booktics/
- **Affected versions:** all versions before 1.0.30
- **Fixed in:** 1.0.30 (Update to 1.0.30 or later.)
- **Severity:** High 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booktics
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1026/

## Description

The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to unauthorized access and modification of data in all versions up to, and including, 1.0.29. This is due to the notification-flow REST routes of the bundled email notification library being registered with a permission callback that always returns true, combined with a sanitizer that skipped HTML filtering for any value containing an SVG element. This makes it possible for unauthenticated attackers to read, create, modify, clone and delete the notification flows that control the emails the site sends, and to store arbitrary web scripts in flow content that execute when an administrator opens the flow in the editor.

## References

- https://wpsec.com/vuln/WPSEC-2026-1026/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.30/
- https://wordpress.org/plugins/booktics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1026/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.