---
id: "CVE-2026-109894"
kind: "vulnerability"
aliases: ["CVE-2026-109894"]
title: "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics\u2026"
severity: "critical"
cvss: 9.3
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "booktics", "fixed": ["1.0.30"], "affected": "<= 1.0.29", "ecosystem": "wordpress-plugin"}]
ecosystems: []
tags: ["booktics", "package", "self-hosted", "sql-injection", "wordpress", "wordpress-plugin"]
not_affected_if: ["booktics-not-installed", "unknown", "version-1.0.30-or-later"]
published_at: "2026-10-18T11:16:36+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T23:27:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109894", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:27:33+00:00"}]
---

# Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…

Unauthenticated SQL injection in the Booktics (Arraytics) WordPress booking plugin, versions up to 1.0.29. A remote attacker needs no login and can read the site database (users, bookings, customer data). Fixed in 1.0.30. Patchstack expects mass exploitation, but no exploitation or public PoC is known yet. The vulnerable endpoint and parameter are not disclosed.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-plugin:booktics affected <= 1.0.29 fixed 1.0.30

## How to check

WordPress admin > Plugins: Booktics version <= 1.0.29 is vulnerable. With WP-CLI: wp plugin get booktics --field=version

## Fix

Update Booktics to 1.0.30 or later (1.0.31 is current on WordPress.org). If you cannot update, deactivate the plugin until you do. Patchstack offers a virtual-patch rule.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109894
- 2026-10-23T23:27:33+00:00 analyst — Patchstack advisory and CVE record: Booktics WordPress plugin <= 1.0.29, unauthenticated SQLi (PR:N), fixed in 1.0.30; wp.org lists 1.0.31 as latest. No PoC or exploitation found; endpoint/parameter not disclosed. No social discussion searched (800 installs).

## Documents

- [advisory] Patchstack: Booktics <= 1.0.29 SQL Injection https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability
- [advisory] CVE record CVE-2026-109894 https://www.cve.org/CVERecord?id=CVE-2026-109894
- [fix] Booktics on WordPress.org https://wordpress.org/plugins/booktics/

## From the sources

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_