{
 "id": "WPSEC-2026-2054",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2054/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2054/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2054/index.md",
 "title": "Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Unauthenticated Missing Authorization to Google Calendar Connection Revocation",
 "description": "The Booktics plugin for WordPress is vulnerable to unauthorized access to its Google Calendar connection REST endpoints in all versions up to, and including, 1.0.31. The permission callback returned a truthy response object instead of a WP_Error when the user was not logged in or lacked permission, so the REST server let these requests through. This makes it possible for unauthenticated attackers to generate authorization URLs, check any user's connection status, and revoke any user's Google Calendar connection.",
 "plugin": {
  "slug": "booktics",
  "name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "full_name": "Booktics – Appointment Booking Calendar for Service Businesses",
  "wordpress_org": "https://wordpress.org/plugins/booktics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/booktics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/booktics"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.32",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.32"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.32",
 "remediation": "Update to 1.0.32 or later.",
 "fix_released": "2026-10-29T11:19:38+00:00",
 "published": "2026-10-30T11:45:14+00:00",
 "updated": "2026-10-29T17:47:29.148627+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2054/",
  "https://plugins.svn.wordpress.org/booktics/tags/1.0.32/",
  "https://wordpress.org/plugins/booktics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/booktics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-30"
 }
}