{"id":"CVE-2026-104674","kind":"vulnerability","aliases":["CVE-2026-104674"],"related":[],"title":"Booktics WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.","summary":"Booktics, a booking plugin from Arraytics, has a missing authorization check that allows access control settings to be exploited. Per the description, versions through 1.0.31 are affected, and an attacker may reach functions they should not be allowed to use.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booktics","other","wordpress"],"not_affected_if":[],"how_to_check":"- Check the installed Booktics version in the plugin list or plugin files","fix":"- Booktics: versions through `1.0.31` are affected; move to a later release","status":"open","published_at":"2026-10-30T19:17:56+00:00","first_seen_at":"2026-10-30T19:25:26+00:00","triaged_at":"2026-10-30T19:26:44+00:00","updated_at":"2026-10-30T19:26:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-10-30T19:26:44Z","model":"claude-haiku-5-5","output":{"fix":"- Booktics: versions through `1.0.31` are affected; move to a later release\n- unknown","reach":"internet","title":"Booktics WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"Booktics, a booking plugin from Arraytics, has a missing authorization check that allows access control settings to be exploited. Per the description, versions through 1.0.31 are affected, and an attacker may reach functions they should not be allowed to use.","audience":"businesses","category":"other","nicknames":[],"who_cares":["booktics","wordpress"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users can reach restricted booking functions","analyst_note":"Confirm the product platform, the affected functions and whether a fixed version exists; check the NVD entry and the vendor's advisory.","how_to_check":"- Check the installed Booktics version in the plugin list or plugin files\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Sites or systems running Booktics up to and including 1.0.31 are affected. The sources do not say which roles or settings must be enabled to reach the flaw, so unknown.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000646,"input_tokens":4105,"output_tokens":471,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-104674':13A,16A '-2026':12A,15A '1.0.31':44B,81C 'access':9A,33B,71C 'affect':46B,76C 'allow':32B,57B,67C 'arrayt':25B,64C 'attack':49B 'author':5A,29B,61C 'book':22B 'booktic':1A,17B,20B,65C,66C,77C 'bypass':8A 'check':30B 'configur':70C 'control':10A,34B,72C 'cve':11A,14A 'descript':41B 'exploit':38B,68C 'function':52B 'incorrect':69C 'issu':75C 'let':6A 'levels.this':74C 'may':50B 'miss':4A,28B,60C 'n/a':79C 'per':39B 'plugin':3A,23B 'reach':51B 'secur':73C 'set':35B 'use':59B 'user':7A 'version':42B 'vulner':62C 'wordpress':2A,19B","nicknames":[],"mitigations":[],"who_affected":"Sites or systems running Booktics up to and including 1.0.31 are affected. The sources do not say which roles or settings must be enabled to reach the flaw, so unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:17:56+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104674","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104674","severity":null,"published_at":"2026-10-30T19:17:56+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:26+00:00","fetched_at":"2026-10-30T19:25:26+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}