CVE-2026-108477: WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Booktics pluginto a version that resolves this vulnerability.Fixed in 1.0.29
Event History
Frequently Asked Questions
Which deployments are affected?
Arraytics Booktics versions through 1.0.28 are affected. The available information does not state whether a particular WordPress configuration or feature must be enabled.
Can an unauthenticated attacker exploit this issue?
The CVSS vector indicates no privileges or user interaction are required, and the attack can be performed over the network. The provided information does not identify the affected endpoint or action.
What is the likely impact if exploitation succeeds?
The CVSS vector indicates integrity impact only, rated low; confidentiality and availability impacts are listed as none. This is consistent with unauthorized modification rather than data disclosure or service disruption.