{"id":"CVE-2026-62122","kind":"vulnerability","aliases":["CVE-2026-62122"],"related":[],"title":"Booktics WordPress plugin: missing authorization check exposes access control, through 1.0.31","description":"Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.","summary":"Booktics, a booking plugin from Arraytics, has a missing authorization check that lets access control settings be exploited. Affected versions are from the start through 1.0.31, according to NVD.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["booktics","other","self-hosted","wordpress"],"not_affected_if":["newer-version"],"how_to_check":"- Look for the Booktics plugin in the installed plugins list and note its version\n- Compare the installed version against `1.0.31`","fix":null,"status":"open","published_at":"2026-10-30T19:18:32+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","triaged_at":"2026-10-30T19:26:31+00:00","updated_at":"2026-10-30T19:26:31+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-30T19:26:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Booktics WordPress plugin: missing authorization check exposes access control, through 1.0.31","impact":"medium","summary":"Booktics, a booking plugin from Arraytics, has a missing authorization check that lets access control settings be exploited. Affected versions are from the start through 1.0.31, according to NVD.","audience":"businesses","category":"other","nicknames":[],"who_cares":["booktics","wordpress","self-hosted"],"confidence":0.4,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users can reach access-controlled booking functions","analyst_note":"Check the NVD entry and the vendor advisory for the affected product name, the platform, the fixed version, and the privilege level needed.","how_to_check":"- Look for the Booktics plugin in the installed plugins list and note its version\n- Compare the installed version against `1.0.31`","plain_action":"","needs_analyst":true,"not_affected_if":["newer-version"],"who_is_affected":"Sites or systems that run the Booktics booking software at version 1.0.31 or earlier. The sources do not describe the required role, the exact endpoint, or the default configuration, so exposure beyond the version range is unknown.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000648,"input_tokens":4105,"output_tokens":476,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-62122':14A,17A '1.0.31':11A,49B,74C 'access':8A,37B,64C 'accord':50B 'affect':42B,69C 'allow':60C 'arrayt':29B,57C 'author':5A,33B,54C 'book':26B 'booktic':1A,18B,24B,58C,59C,70C 'check':6A,34B 'configur':63C 'control':9A,38B,65C 'cve':12A,15A 'exploit':41B,61C 'expos':7A 'host':22B 'incorrect':62C 'issu':68C 'let':36B 'levels.this':67C 'miss':4A,32B,53C 'n/a':72C 'nvd':52B 'plugin':3A,27B 'secur':66C 'self':21B 'self-host':20B 'set':39B 'start':47B 'version':43B 'vulner':55C 'wordpress':2A,23B","nicknames":[],"mitigations":[],"who_affected":"Sites or systems that run the Booktics booking software at version 1.0.31 or earlier. The sources do not describe the required role, the exact endpoint, or the default configuration, so exposure beyond the version range is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T19:18:32+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-62122","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62122","severity":null,"published_at":"2026-10-30T19:18:32+00:00","modified_at":"2026-10-30T19:22:27+00:00","first_seen_at":"2026-10-30T19:25:30+00:00","fetched_at":"2026-10-30T19:25:30+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}