Arraytics Booktics WordPress Plugin Missing Authorization Vulnerability (CVE-2026-104674)

Affected Vendors

Arraytics

Affected Components

Booktics

Published Date

2026-10-30

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Booktics WordPress plugin versions up to 1.0.31.

Impact

Authenticated users with low privileges can access unauthorized data or functions due to broken access control.

Mitigation

Update to the latest version (1.0.32 or higher) immediately.

Affected Products & Version Scope

All WordPress installations running Booktics plugin version 1.0.31 or earlier are vulnerable.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

The primary remediation is to update the plugin to the latest patched version.

1. Plugin Update

Navigate to the WordPress Plugins menu and update Booktics to the latest available version.

2. Update via WP-CLI

If you have terminal access, you can update the plugin using the following command:

bash

wp plugin update booktics

3. Temporary Mitigation

If patching is delayed, implement WAF (Web Application Firewall) rules to filter and block suspicious requests targeting administrative AJAX or API endpoints associated with the plugin.

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

Apply the latest security patch (v1.0.32 or higher) provided by the vendor to mitigate the risk of authorization bypass.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

This vulnerability is categorized under CWE-862 (Missing Authorization). The Booktics plugin fails to perform adequate server-side permission checks on specific endpoints. An attacker with a low-privileged account can exploit this misconfiguration to bypass intended access restrictions and view sensitive information. With an EPSS score of 0.42, there is a significant likelihood of this vulnerability being targeted in the wild.

Official Vendor Advisories & References

NVD Original English Description

Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.31.

https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-31-broken-access-control-vulnerability-2?_s_id=cve

Source: audit@patchstack.com

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: