Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Unauthenticated Missing Authorization to Google Calendar Account Connection Overwrite via OAuth 'state' Parameter
- ID
- WPSEC-2026-2052
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- from 1.0.31 before 1.0.32
- Remediation
- Update to 1.0.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-30
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics plugin for WordPress is vulnerable to unauthorized modification of data via the Google Calendar OAuth callback in all versions up to, and including, 1.0.31. The handle_google_auth_callback() function runs on template_redirect for logged-out visitors and trusted a caller-controlled, base64-encoded JSON 'state' value naming the target team member, falling back to the current user when state was absent, without verifying who initiated the flow or whether they could manage that user. This makes it possible for unauthenticated attackers to overwrite any user's stored Google tokens by submitting an authorization code for their own Google account with a forged state naming that user, and to perform login CSRF against the calendar connection.
References
- https://wpsec.com/vuln/WPSEC-2026-2052/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.32/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS