{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1919", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-04T16:38:59.005Z", "datePublished": "2026-03-10T02:21:49.636Z", "dateUpdated": "2026-04-08T17:21:36.464Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:36.464Z"}, "affected": [{"vendor": "arraytics", "product": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.16", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Booking Calendar for Appointments and Service Businesses \u2013 Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data."}], "title": "Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88dcf62-4b6c-4ff0-8530-5aefd54bd347?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/customer/controllers/customer-controller.php#L229"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/team-member/controllers/team-member-controller.php#L235"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/order/controllers/order-controller.php#L889"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/appointment/controllers/appointment-controller.php#L549"}, {"url": "https://plugins.trac.wordpress.org/changeset/3477898/booktics"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-306 Missing Authentication for Critical Function", "cweId": "CWE-306", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "timeline": [{"time": "2026-03-09T09:46:27.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-03-09T13:22:08.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-10T15:58:07.258724Z", "id": "CVE-2026-1919", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T16:52:18.141Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1919", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-10T15:58:07.258724Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-10T15:58:08.298Z"}}], "cna": {"title": "Booktics <= 1.0.16 - Missing Authorization to Get Items via REST API endpoints", "credits": [{"lang": "en", "type": "finder", "value": "Kazuma Matsumoto"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"}}], "affected": [{"vendor": "arraytics", "product": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0.16"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-09T09:46:27.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-03-09T13:22:08.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88dcf62-4b6c-4ff0-8530-5aefd54bd347?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/customer/controllers/customer-controller.php#L229"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/team-member/controllers/team-member-controller.php#L235"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/order/controllers/order-controller.php#L889"}, {"url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/appointment/controllers/appointment-controller.php#L549"}, {"url": "https://plugins.trac.wordpress.org/changeset/3477898/booktics"}], "descriptions": [{"lang": "en", "value": "The Booking Calendar for Appointments and Service Businesses \u2013 Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:21:36.464Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1919", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:21:36.464Z", "dateReserved": "2026-02-04T16:38:59.005Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-10T02:21:49.636Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses", "vendor": "arraytics", "versions": [{"lessThanOrEqual": "1.0.16", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Booking Calendar for Appointments and Service Businesses \u2013 Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data."}, {"lang": "es", "value": "El plugin Booking Calendar para Appointments and Service Businesses \u2013 Booktics para WordPress es vulnerable al acceso no autorizado de datos debido a una falta de verificaci\u00f3n de capacidad en m\u00faltiples endpoints de la API REST en todas las versiones hasta la 1.0.16, inclusive. Esto permite a atacantes no autenticados consultar datos sensibles."}], "id": "CVE-2026-1919", "lastModified": "2026-06-17T10:16:43.270", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1919", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-10T15:58:07.258724Z", "version": "2.0.3"}}]}, "published": "2026-03-10T17:32:45.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/appointment/controllers/appointment-controller.php#L549"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/customer/controllers/customer-controller.php#L229"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/order/controllers/order-controller.php#L889"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/team-member/controllers/team-member-controller.php#L235"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3477898/booktics"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c88dcf62-4b6c-4ff0-8530-5aefd54bd347?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.0.16]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Booktics \u2013 Booking Calendar for Appointments and Service Businesses", "source": "cna", "vendor": "arraytics"}, "product": "booktics_\u2013_booking_calendar_for_appointments_and_service_businesses", "vendor": "arraytics"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T16:41:46.202762+00:00", "value": {"mitigation_remediation": ["Upgrade the Booktics plugin to the latest available release, which includes the necessary capability checks to protect sensitive data.", "If an immediate upgrade is not feasible, restrict access to the affected REST API endpoints by implementing server\u2011side access controls (e.g., using .htaccess, firewall rules, or API authentication mechanisms) so only authenticated users can call them.", "Consider applying the patch referenced in the plugin source code directly, or enable a security plugin that blocks unauthenticated REST access to WordPress endpoints."], "summary": {"action": "Immediate Patch", "impact": "Unauthorized data exposure via missing authentication"}, "threat_synthesis": {"affected_systems": "All published releases of the Booktics plugin for WordPress, from the initial release through version 1.0.16, are affected. The issue resides in various REST API controllers such as appointment, customer, order, and team member endpoints.", "description_and_impact": "The Booking Calendar for Appointments and Service Businesses \u2013 Booktics plugin for WordPress has a missing capability check on multiple REST API endpoints in all versions up to 1.0.16, which allows an unauthenticated attacker to query sensitive data. This results in a confidentiality breach, potentially exposing customer information, appointments, orders, and team member details. The vulnerability corresponds to CWE-306, indicating a lack of proper authorization checks.", "risk_and_exploitability": "The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the affected endpoints over the network and perform unauthenticated GET requests, without needing elevated privileges or additional credentials. The lack of an authentication guard makes exploitation straightforward, but its visibility and impact remain limited to data confidentiality."}}}}, "created": "2026-03-10T14:06:04.718317+00:00", "updated": "2026-04-15T17:00:07.028785+00:00", "vendors": ["arraytics", "arraytics$PRODUCT$booktics_\u2013_booking_calendar_for_appointments_and_service_businesses", "wordpress", "wordpress$PRODUCT$wordpress"]}