Platform
wordpress
Component
booktics
Fixed in
1.0.17
CVE-2026-1920 affects the Booktics WordPress plugin, a booking calendar for appointments and service businesses. This vulnerability allows unauthenticated attackers to install addon plugins, potentially leading to unauthorized modifications and control over the plugin’s functionality. The vulnerability impacts versions 1.0.0 through 1.0.16, and a fix is available in version 1.0.17.
The core impact of CVE-2026-1920 lies in the ability of an unauthenticated attacker to install arbitrary addon plugins within the Booktics WordPress plugin. This bypasses intended security controls and allows malicious code to be introduced into the WordPress environment. Attackers could leverage this to gain persistent access, steal sensitive data (customer information, appointment details), or even compromise the entire WordPress site. The potential blast radius extends beyond the plugin itself, potentially affecting the entire WordPress installation and any connected systems. This vulnerability highlights the importance of robust capability checks in plugin development to prevent unauthorized access and modification.
CVE-2026-1920 was publicly disclosed on 2026-03-10. There are currently no known public proof-of-concept exploits available. The vulnerability's relatively simple nature suggests that a PoC could be developed quickly. It is not currently listed on the CISA KEV catalog, but its ease of exploitation warrants monitoring. The EPSS score is likely to be assessed as low to medium, reflecting the need for authentication to exploit the vulnerability.
Exploit Status
EPSS
0.04% (14% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-1920 is to immediately upgrade the Booktics plugin to version 1.0.17 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the plugin's administrative interface. While not a complete solution, this can limit the attacker’s ability to exploit the vulnerability. Monitor WordPress access logs for suspicious activity, particularly attempts to install plugins from unknown sources. Implement a WordPress security plugin with robust access control features to further harden the environment.
Update to version 1.0.17, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-1920 is a vulnerability in the Booktics WordPress plugin allowing unauthenticated attackers to install addon plugins due to a missing capability check. This impacts versions 1.0.0–1.0.16.
You are affected if your WordPress site uses the Booktics plugin and is running version 1.0.0 through 1.0.16. Check your plugin version immediately.
Upgrade the Booktics plugin to version 1.0.17 or later to resolve the vulnerability. If immediate upgrade is not possible, restrict access to the plugin’s admin interface.
There are currently no confirmed reports of active exploitation, but the vulnerability's simplicity suggests it could be exploited.
Refer to the Booktics plugin website or WordPress plugin repository for the official advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.