---
id: "CVE-2026-112829"
kind: "vulnerability"
aliases: ["CVE-2026-112829"]
title: "Booktics WordPress plugin: missing authorization lets users reach restricted functions"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["booktics", "package", "self-hosted", "wordpress"]
not_affected_if: ["patched-version", "plugin-not-installed"]
published_at: "2026-10-20T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:20+00:00"
updated_at: "2026-10-25T04:24:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112829", "first_seen_at": "2026-10-23T21:57:20+00:00"}]
---

# Booktics WordPress plugin: missing authorization lets users reach restricted functions

Booktics, a booking plugin by Arraytics, lacks an authorization check on some functionality, so access control is not enforced as intended. An attacker may be able to perform actions or read data their role should not allow.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Booktics version and compare it with `1.0.30`
- Look for the plugin in the WordPress plugins list or in the plugin directory under `wp-content/plugins/booktics`
- unknown for which specific endpoints are affected

## Fix

- Update Booktics to a version later than `1.0.30`, as published by the vendor
- unknown whether a patched version is released yet

## Timeline

- 2026-10-23T21:57:20+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112829

## From the sources

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_