---
id: "CVE-2026-104674"
kind: "vulnerability"
aliases: ["CVE-2026-104674"]
title: "Booktics WordPress plugin: missing authorization lets users bypass access controls"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["booktics", "other", "wordpress"]
not_affected_if: []
published_at: "2026-10-30T19:17:56+00:00"
first_seen_at: "2026-10-30T19:25:26+00:00"
updated_at: "2026-10-30T19:26:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104674", "first_seen_at": "2026-10-30T19:25:26+00:00"}]
---

# Booktics WordPress plugin: missing authorization lets users bypass access controls

Booktics, a booking plugin from Arraytics, has a missing authorization check that allows access control settings to be exploited. Per the description, versions through 1.0.31 are affected, and an attacker may reach functions they should not be allowed to use.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Booktics version in the plugin list or plugin files

## Fix

- Booktics: versions through `1.0.31` are affected; move to a later release

## Timeline

- 2026-10-30T19:25:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104674

## From the sources

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_