How do I check whether I am affected by CVE-2026-109894?

WordPress admin > Plugins: Booktics version <= 1.0.29 is vulnerable. With WP-CLI: wp plugin get booktics --field=version

What is the fix for CVE-2026-109894?

Update Booktics to 1.0.30 or later (1.0.31 is current on WordPress.org). If you cannot update, deactivate the plugin until you do. Patchstack offers a virtual-patch rule.

Who is not affected by CVE-2026-109894?

Not affected if: booktics-not-installed, unknown, version-1.0.30-or-later.

Live › vulnerability › CVE-2026-109894

Go to dashboard

critical9.3Package

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…

Q: What is the fix for CVE-2026-109894?

Update Booktics to 1.0.30 or later (1.0.31 is current on WordPress.org). If you cannot update, deactivate the plugin until you do. Patchstack offers a virtual-patch rule.

Q: Who is not affected by CVE-2026-109894?

Not affected if: booktics-not-installed, unknown, version-1.0.30-or-later.

Unauthenticated SQL injection in the Booktics (Arraytics) WordPress booking plugin, versions up to 1.0.29. A remote attacker needs no login and can read the site database (users, bookings, customer data). Fixed in 1.0.30. Patchstack expects mass exploitation, but no exploitation or public PoC is known yet. The vulnerable endpoint and parameter are not disclosed.

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or modifies database contents through injected SQL queries.
CVSS said: 9.3. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-109894

Go to dashboard

critical9.3Package

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…

Summary written from the sources below. Check the originals before acting.

CVSS 3.x

9.3

critical

scored by [email protected]

known so far5 of 6

missing: exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Attacker reads or modifies database contents through injected SQL queries.
CVSS said: 9.3. The facts above say high; we keep the sources' critical until an analyst looks.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources