Platform
wordpress
Component
booktics
Opgelost in
1.0.17
CVE-2026-1920 affects the Booktics WordPress plugin, a booking calendar for appointments and service businesses. This vulnerability allows unauthenticated attackers to install addon plugins, potentially leading to unauthorized modifications and control over the plugin’s functionality. The vulnerability impacts versions 1.0.0 through 1.0.16, and a fix is available in version 1.0.17.
The core impact of CVE-2026-1920 lies in the ability of an unauthenticated attacker to install arbitrary addon plugins within the Booktics WordPress plugin. This bypasses intended security controls and allows malicious code to be introduced into the WordPress environment. Attackers could leverage this to gain persistent access, steal sensitive data (customer information, appointment details), or even compromise the entire WordPress site. The potential blast radius extends beyond the plugin itself, potentially affecting the entire WordPress installation and any connected systems. This vulnerability highlights the importance of robust capability checks in plugin development to prevent unauthorized access and modification.
CVE-2026-1920 was publicly disclosed on 2026-03-10. There are currently no known public proof-of-concept exploits available. The vulnerability's relatively simple nature suggests that a PoC could be developed quickly. It is not currently listed on the CISA KEV catalog, but its ease of exploitation warrants monitoring. The EPSS score is likely to be assessed as low to medium, reflecting the need for authentication to exploit the vulnerability.
Websites utilizing the Booktics plugin for appointment scheduling and service businesses are at risk. Specifically, sites running older versions (1.0.0–1.0.16) are vulnerable. Shared hosting environments where plugin updates are managed centrally are particularly susceptible, as they may not have immediate control over plugin versions.
• wordpress / composer / npm:
wp plugin list | grep Booktics• wordpress / composer / npm:
wp plugin update --all• wordpress / composer / npm:
wp plugin status Booktics• wordpress / composer / npm:
wp option get booktics_versiondisclosure
Exploit Status
EPSS
0.04% (14% percentiel)
CISA SSVC
CVSS-vector
The primary mitigation for CVE-2026-1920 is to immediately upgrade the Booktics plugin to version 1.0.17 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider temporarily restricting access to the plugin's administrative interface. While not a complete solution, this can limit the attacker’s ability to exploit the vulnerability. Monitor WordPress access logs for suspicious activity, particularly attempts to install plugins from unknown sources. Implement a WordPress security plugin with robust access control features to further harden the environment.
Update naar versie 1.0.17, of een nieuwere gepatchte versie
Kwetsbaarheidsanalyses en kritieke waarschuwingen direct in uw inbox.
CVE-2026-1920 is a vulnerability in the Booktics WordPress plugin allowing unauthenticated attackers to install addon plugins due to a missing capability check. This impacts versions 1.0.0–1.0.16.
You are affected if your WordPress site uses the Booktics plugin and is running version 1.0.0 through 1.0.16. Check your plugin version immediately.
Upgrade the Booktics plugin to version 1.0.17 or later to resolve the vulnerability. If immediate upgrade is not possible, restrict access to the plugin’s admin interface.
There are currently no confirmed reports of active exploitation, but the vulnerability's simplicity suggests it could be exploited.
Refer to the Booktics plugin website or WordPress plugin repository for the official advisory and update information.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.
Upload je dependency-bestand en kom direct te weten of deze en andere CVEs jou raken.