CVE-2026-109894

9.3Critical

Published 18 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

9.3Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on confidentiality
Weakness: CWE-89

Impact

Unauthenticated remote attackers can execute arbitrary SQL queries against the backend database without privileges or user interaction. This can expose sensitive data and potentially disrupt database availability.

Root cause

The plugin fails to neutralize user-supplied input before incorporating it into SQL commands.

Affected systems

Arraytics Booktics plugin through 1.0.29

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L

Fix & remediation

Upgrade Booktics to a version newer than 1.0.29 if available; otherwise, deactivate and uninstall the plugin immediately.

shell

$ wp plugin deactivate booktics

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

References

https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-109894