{"id":"CVE-2026-109894","kind":"vulnerability","aliases":["CVE-2026-109894"],"related":[],"title":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.","summary":"Unauthenticated SQL injection in the Booktics (Arraytics) WordPress booking plugin, versions up to 1.0.29. A remote attacker needs no login and can read the site database (users, bookings, customer data). Fixed in 1.0.30. Patchstack expects mass exploitation, but no exploitation or public PoC is known yet. The vulnerable endpoint and parameter are not disclosed.","severity":"critical","cvss":9.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"booktics","fixed":["1.0.30"],"affected":"<= 1.0.29","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["booktics","package","self-hosted","sql-injection","wordpress","wordpress-plugin"],"not_affected_if":["booktics-not-installed","unknown","version-1.0.30-or-later"],"how_to_check":"WordPress admin > Plugins: Booktics version <= 1.0.29 is vulnerable. With WP-CLI: wp plugin get booktics --field=version","fix":"Update Booktics to 1.0.30 or later (1.0.31 is current on WordPress.org). If you cannot update, deactivate the plugin until you do. Patchstack offers a virtual-patch rule.","status":"open","published_at":"2026-10-18T11:16:36+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:08:51+00:00","updated_at":"2026-10-23T23:27:33+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:08:51Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade Booktics to a version newer than 1.0.29 once a patched release is confirmed; unknown whether a fixed version exists.","reach":"internet","impact":"high","summary":"Booktics by Arraytics is vulnerable to SQL injection in versions up to and including 1.0.29. An attacker can send crafted input to run arbitrary SQL against the application's database.","category":"package","who_cares":["booktics","wordpress","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker reads or modifies database contents through injected SQL queries","analyst_note":"Confirm the product platform (likely a WordPress plugin), the vulnerable parameter, whether auth is required, and whether a patched version exists; check the NVD entry and the vendor advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00045,"input_tokens":2743,"output_tokens":352,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the product platform (likely a WordPress plugin), the vulnerable parameter, whether auth is required, and whether a patched version exists; check the NVD entry and the vendor advisory.","search":"'-109894':18A,21A '-2026':17A,20A '1.0.29':48B,115C '1.0.30':67B 'affect':110C 'allow':106C 'arrayt':15A,41B,103C 'attack':51B 'book':43B,62B 'booktic':23B,40B,104C,105C,111C 'booktics':22A 'command':10A,98C 'custom':63B 'cve':16A,19A 'data':64B 'databas':60B 'disclos':88B 'element':5A,93C 'endpoint':83B 'expect':69B 'exploit':71B,74B 'fix':65B 'host':27B 'improp':1A,89C 'inject':12A,30B,37B,100C 'injection.this':108C 'issu':109C 'known':79B 'login':54B 'mass':70B 'n/a':113C 'need':52B 'neutral':2A,90C 'packag':24B 'paramet':85B 'patchstack':68B 'plugin':34B,44B 'poc':77B 'public':76B 'read':57B 'remot':50B 'self':26B 'self-host':25B 'site':59B 'special':4A,92C 'sql':9A,11A,29B,36B,97C,99C,107C 'sql-inject':28B 'unauthent':35B 'use':6A,94C 'user':61B 'version':45B 'vulner':13A,82B,101C 'wordpress':31B,33B,42B 'wordpress-plugin':32B 'yet':80B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T11:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109894","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109894","severity":null,"published_at":"2026-10-18T11:16:36+00:00","modified_at":"2026-10-19T16:17:02+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-109894:447","url":null,"severity":null,"published_at":"2026-10-23T23:27:33+00:00","modified_at":"2026-10-23T23:27:33+00:00","first_seen_at":"2026-10-23T23:27:33+00:00","fetched_at":"2026-10-23T23:27:33+00:00","note":"Patchstack advisory and CVE record: Booktics WordPress plugin <= 1.0.29, unauthenticated SQLi (PR:N), fixed in 1.0.30; wp.org lists 1.0.31 as latest. No PoC or exploitation found; endpoint/parameter not disclosed. No social discussion searched (800 installs)."}],"documents":[{"id":1971,"url":"https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability","title":"Patchstack: Booktics <= 1.0.29 SQL Injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1972,"url":"https://www.cve.org/CVERecord?id=CVE-2026-109894","title":"CVE record CVE-2026-109894","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1973,"url":"https://wordpress.org/plugins/booktics/","title":"Booktics on WordPress.org","kind":"release","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}