Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter
- ID
- WPSEC-2026-1383
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- all versions before 1.0.31
- Remediation
- Update to 1.0.31 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'customer_id' parameter of the public order creation REST endpoint (POST /wp-json/booktics/v1/orders) in all versions up to, and including, 1.0.30, due to missing validation that the supplied customer ID belongs to the current user. The order and its appointments are created under the named customer record, and the response returns that customer's name, email address and phone number. This makes it possible for unauthenticated attackers to enumerate customer IDs to obtain other customers' personal details and to place bookings under other customers' records.
References
- https://wpsec.com/vuln/WPSEC-2026-1383/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.31/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS