# Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Unauthenticated Missing Authorization to Google Calendar Account Connection Overwrite via OAuth 'state' Parameter

- **ID:** WPSEC-2026-2052
- **Plugin:** Booktics – Appointment Booking Calendar for Service Businesses (`booktics`), https://wordpress.org/plugins/booktics/
- **Affected versions:** from 1.0.31 before 1.0.32
- **Fixed in:** 1.0.32 (Update to 1.0.32 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booktics
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2052/

## Description

The Booktics plugin for WordPress is vulnerable to unauthorized modification of data via the Google Calendar OAuth callback in all versions up to, and including, 1.0.31. The handle_google_auth_callback() function runs on template_redirect for logged-out visitors and trusted a caller-controlled, base64-encoded JSON 'state' value naming the target team member, falling back to the current user when state was absent, without verifying who initiated the flow or whether they could manage that user. This makes it possible for unauthenticated attackers to overwrite any user's stored Google tokens by submitting an authorization code for their own Google account with a forged state naming that user, and to perform login CSRF against the calendar connection.

## References

- https://wpsec.com/vuln/WPSEC-2026-2052/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.32/
- https://wordpress.org/plugins/booktics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2052/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.