CVE-2026-1919

Published: Mar 10, 2026Modified: Jun 17, 2026Deferred

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: security@wordfence.com (Secondary)

Description

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.

Related CWEs

Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

References (6)

https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/appointment/controllers/appointment-controller.php#L549

Source: security@wordfence.com

https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/customer/controllers/customer-controller.php#L229

Source: security@wordfence.com

https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/order/controllers/order-controller.php#L889

Source: security@wordfence.com

https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/team-member/controllers/team-member-controller.php#L235

Source: security@wordfence.com

https://plugins.trac.wordpress.org/changeset/3477898/booktics

Source: security@wordfence.com

https://www.wordfence.com/threat-intel/vulnerabilities/id/c88dcf62-4b6c-4ff0-8530-5aefd54bd347?source=cve

Source: security@wordfence.com

Timeline

No history available yet.