{
 "id": "WPSEC-2026-1383",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1383/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1383/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1383/index.md",
 "title": "Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter",
 "description": "The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'customer_id' parameter of the public order creation REST endpoint (POST /wp-json/booktics/v1/orders) in all versions up to, and including, 1.0.30, due to missing validation that the supplied customer ID belongs to the current user. The order and its appointments are created under the named customer record, and the response returns that customer's name, email address and phone number. This makes it possible for unauthenticated attackers to enumerate customer IDs to obtain other customers' personal details and to place bookings under other customers' records.",
 "plugin": {
  "slug": "booktics",
  "name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "full_name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "wordpress_org": "https://wordpress.org/plugins/booktics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booktics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booktics"
 },
 "type": "IDOR",
 "cwe": [
  "CWE-639"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.5,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.31",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.31"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.31",
 "remediation": "Update to 1.0.31 or later.",
 "fix_released": "2026-10-19T17:58:18+00:00",
 "published": "2026-10-21T13:44:54+00:00",
 "updated": "2026-10-21T13:34:04.686429+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1383/",
  "https://plugins.svn.wordpress.org/booktics/tags/1.0.31/",
  "https://wordpress.org/plugins/booktics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booktics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}