Vulnerabilities / Booktics – Appointment Booking Calendar for Service Businesses / WPSEC-2026-2054
Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Unauthenticated Missing Authorization to Google Calendar Connection Revocation
Medium 5.3
CWE-862Fixed in 1.0.32
- ID
- WPSEC-2026-2054
- Plugin
- Booktics – Appointment Booking Calendar for Service Businesses (booktics)
- Affected
- all versions before 1.0.32
- Remediation
- Update to 1.0.32 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-30
- Attack surface
- Booktics – Appointment Booking Calendar for Service Businesses on WPSec AttackSurface
- Fix released
- Published
Description
The Booktics plugin for WordPress is vulnerable to unauthorized access to its Google Calendar connection REST endpoints in all versions up to, and including, 1.0.31. The permission callback returned a truthy response object instead of a WP_Error when the user was not logged in or lacked permission, so the REST server let these requests through. This makes it possible for unauthenticated attackers to generate authorization URLs, check any user's connection status, and revoke any user's Google Calendar connection.
References
- https://wpsec.com/vuln/WPSEC-2026-2054/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.32/
- https://wordpress.org/plugins/booktics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS