CVE-2026-107418
5.4MediumPublished 12 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Limited impact
- Weakness
- CWE-862
Impact
Authenticated attackers with low privileges can bypass access controls to read and modify restricted data. They only require network access and a basic user account on the target WordPress site.
Root cause
The plugin fails to perform proper authorization checks when enforcing access control levels.
Affected systems
Arraytics Booktics through 1.0.28
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Fix & remediation
Upgrade to a version newer than 1.0.28 once available, or deactivate and remove the Booktics plugin immediately if no patch is out.
$ wp plugin deactivate bookticsAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.