# Booktics – Appointment Booking Calendar for Service Businesses <= 1.0.31 - Unauthenticated Missing Authorization to Google Calendar Connection Revocation

- **ID:** WPSEC-2026-2054
- **Plugin:** Booktics – Appointment Booking Calendar for Service Businesses (`booktics`), https://wordpress.org/plugins/booktics/
- **Affected versions:** all versions before 1.0.32
- **Fixed in:** 1.0.32 (Update to 1.0.32 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-30)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/booktics
- **Fix released:** 2026-10-29
- **Published:** 2026-10-30
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2054/

## Description

The Booktics plugin for WordPress is vulnerable to unauthorized access to its Google Calendar connection REST endpoints in all versions up to, and including, 1.0.31. The permission callback returned a truthy response object instead of a WP_Error when the user was not logged in or lacked permission, so the REST server let these requests through. This makes it possible for unauthenticated attackers to generate authorization URLs, check any user's connection status, and revoke any user's Google Calendar connection.

## References

- https://wpsec.com/vuln/WPSEC-2026-2054/
- https://plugins.svn.wordpress.org/booktics/tags/1.0.32/
- https://wordpress.org/plugins/booktics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2054/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.