CVE-2026-104390 Overview
CVE-2026-104390 is a Missing Authorization vulnerability [CWE-862] in the Arraytics Booktics WordPress plugin. The flaw affects all versions from the initial release through 1.0.27. Attackers with low-privilege authenticated access can exploit incorrectly configured access control security levels to reach functionality that should be restricted. The vulnerability stems from the plugin failing to verify user permissions before executing privileged actions. Successful exploitation leads to limited confidentiality impact against affected WordPress sites running the plugin.
Critical Impact
Authenticated users with low privileges can bypass access controls in the Booktics plugin to read restricted data on affected WordPress sites.
Affected Products
- Arraytics Booktics plugin for WordPress
- All versions from initial release through 1.0.27
- WordPress installations with the vulnerable plugin active
Discovery Timeline
- 2026-10-07 - CVE-2026-104390 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-104390
Vulnerability Analysis
The Booktics plugin exposes functionality that lacks proper authorization checks. The plugin trusts authenticated requests without validating whether the requesting user holds the required capability for the action. This is a classic Broken Access Control pattern [CWE-862] where authentication is conflated with authorization.
An attacker needs only a low-privilege authenticated account, such as a subscriber-level user, to invoke the affected endpoints. The attack is executed over the network against the WordPress site and does not require user interaction. Impact is limited to confidentiality; integrity and availability of the site remain unaffected.
Root Cause
The root cause is missing or incorrectly configured capability checks in plugin request handlers. Secure WordPress plugin design requires current_user_can() checks and nonce validation before processing privileged operations. The Booktics plugin, through version 1.0.27, omits these checks on one or more handlers, allowing any authenticated user to invoke protected logic.
Attack Vector
Exploitation requires network access to the target WordPress site and a valid low-privilege account. The attacker sends crafted HTTP requests to the vulnerable plugin endpoints, typically via admin-ajax.php or REST API routes registered by the plugin. Because the handlers do not verify the caller's role or capability, the backend executes the request and returns data that should be restricted. No specialized tooling is required beyond standard web request utilities.
See the Patchstack Booktics Plugin Vulnerability entry for additional technical context.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-104390
Indicators of Compromise
- Unexpected requests from low-privilege accounts to Booktics plugin AJAX actions or REST routes
- Access log entries showing subscriber-level sessions calling administrative plugin endpoints
- Anomalous data retrieval patterns from the WordPress database tables associated with Booktics
Detection Strategies
- Review WordPress access logs for POST and GET requests to admin-ajax.php containing Booktics-specific action parameters originating from non-admin users
- Correlate authenticated session cookies with request types that should require elevated capabilities
- Deploy a Web Application Firewall rule to flag requests to plugin endpoints when the authenticated user role does not match the expected privilege level
Monitoring Recommendations
- Enable verbose logging on the WordPress REST API and admin-ajax.php handlers
- Monitor newly registered subscriber accounts followed by immediate requests to plugin endpoints
- Track plugin version inventory across managed WordPress sites to identify unpatched Booktics installations
How to Mitigate CVE-2026-104390
Immediate Actions Required
- Identify all WordPress sites running the Arraytics Booktics plugin at version 1.0.27 or earlier
- Upgrade to a vendor-released patched version once available from Arraytics
- Audit user accounts and remove unnecessary low-privilege accounts that could be weaponized
- Review recent plugin-related requests for signs of unauthorized data access
Patch Information
At the time of publication, the vendor advisory tracked by Patchstack indicates the vulnerability affects Booktics through version 1.0.27. Administrators should consult the Patchstack advisory and the Arraytics plugin changelog for the fixed version and apply it as soon as it is released.
Workarounds
- Deactivate the Booktics plugin until a patched release is installed
- Restrict access to WordPress authenticated endpoints using WAF rules that validate role claims
- Disable self-registration on WordPress sites to reduce the pool of low-privilege attackers
- Apply virtual patching through a managed WordPress security provider while awaiting the official fix
# Disable the Booktics plugin via WP-CLI pending a vendor patch
wp plugin deactivate booktics
# Verify plugin status
wp plugin status booktics
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
