# Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.30 - Unauthenticated Insecure Direct Object Reference to Customer Information Exposure via 'customer_id' Parameter

- **ID:** WPSEC-2026-1383
- **Plugin:** Booktics – Appointment Booking Calendar for Service Businesses (`booktics`), https://wordpress.org/plugins/booktics/
- **Affected versions:** all versions before 1.0.31
- **Fixed in:** 1.0.31 (Update to 1.0.31 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booktics
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1383/

## Description

The Booktics – Appointment Booking Calendar for Service Businesses plugin for WordPress is vulnerable to Insecure Direct Object Reference via the 'customer_id' parameter of the public order creation REST endpoint (POST /wp-json/booktics/v1/orders) in all versions up to, and including, 1.0.30, due to missing validation that the supplied customer ID belongs to the current user. The order and its appointments are created under the named customer record, and the response returns that customer's name, email address and phone number. This makes it possible for unauthenticated attackers to enumerate customer IDs to obtain other customers' personal details and to place bookings under other customers' records.

## References

- https://wpsec.com/vuln/WPSEC-2026-1383/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.31/
- https://wordpress.org/plugins/booktics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1383/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.