CVE-2026-112829 Overview
CVE-2026-112829 is a Missing Authorization vulnerability [CWE-862] in the Arraytics Booktics WordPress plugin. The flaw affects all versions of Booktics up to and including 1.0.30. The plugin exposes functionality protected by incorrectly configured access control security levels, allowing unauthenticated network-based requests to reach actions that should require authorization.
The issue results in low-impact confidentiality exposure without requiring privileges or user interaction. No authentication bypass of credentialed accounts is required, and the attack vector is remote over the network.
Critical Impact
Unauthenticated attackers can reach plugin functionality that lacks proper authorization checks, enabling disclosure of information that should be access-restricted on affected WordPress sites.
Affected Products
- Arraytics Booktics WordPress plugin versions n/a through 1.0.30
- WordPress installations with the Booktics plugin enabled
- Any site exposing Booktics endpoints to unauthenticated network traffic
Discovery Timeline
- 2026-10-20 - CVE CVE-2026-112829 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-112829
Vulnerability Analysis
The vulnerability is a Broken Access Control issue in the Booktics plugin. One or more plugin handlers execute privileged operations without verifying that the requester holds the required capability or role. An attacker sends crafted HTTP requests to the exposed endpoints and receives data or triggers actions that should be gated behind authentication and authorization checks.
Because the attack vector is network-based with low complexity and no privileges or user interaction required, exploitation can be fully automated against internet-exposed WordPress sites running vulnerable Booktics versions. The direct impact is limited to confidentiality, with no integrity or availability consequences identified.
Root Cause
The root cause is a missing authorization check [CWE-862]. The plugin registers callbacks—likely AJAX actions or REST routes—that do not call a capability check such as current_user_can() or an equivalent permission_callback before executing. The access control security level is incorrectly configured for the sensitivity of the exposed functionality.
Attack Vector
An unauthenticated remote attacker issues HTTP requests to the vulnerable Booktics endpoints on a WordPress site. Because no authorization is enforced server-side, the plugin processes the request and returns information or performs an action restricted to authorized users. See the Patchstack Vulnerability Report for additional technical context. No verified proof-of-concept code is published at this time.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-112829
Indicators of Compromise
- Unauthenticated HTTP requests to Booktics-registered admin-ajax.php actions or REST routes returning HTTP 200 with sensitive payloads.
- Access log entries from unknown or anonymous sources targeting /wp-json/ paths associated with the Booktics plugin.
- Spikes in request volume to Booktics endpoints without accompanying session cookies or nonce parameters.
Detection Strategies
- Inventory WordPress sites and identify any instance running Booktics at version 1.0.30 or earlier.
- Review web server logs for anonymous requests to Booktics endpoints returning successful responses with non-trivial body sizes.
- Correlate WordPress audit logs with web access logs to identify data retrievals not tied to an authenticated session.
Monitoring Recommendations
- Deploy web application firewall rules to log and alert on unauthenticated access to Booktics plugin endpoints.
- Monitor outbound response sizes for Booktics requests to detect bulk data retrieval patterns.
- Alert on new or unexpected URI paths introduced by plugin updates on production WordPress sites.
How to Mitigate CVE-2026-112829
Immediate Actions Required
- Update the Booktics plugin to a version released after 1.0.30 once a patched release is available from Arraytics.
- Restrict public access to Booktics endpoints at the reverse proxy or WAF layer until a patch is applied.
- Audit WordPress user accounts and recent activity for any evidence of data access that cannot be attributed to a legitimate session.
Patch Information
The vulnerability affects Booktics through 1.0.30. Consult the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the vendor-supplied update as soon as it is published.
Workarounds
- Disable the Booktics plugin on affected WordPress sites until a fixed version is installed.
- Add WAF rules that block unauthenticated requests to the specific plugin AJAX actions and REST routes.
- Enforce IP allow-listing on /wp-admin/admin-ajax.php and /wp-json/ paths where feasible for the affected sites.
# Configuration example: temporarily deactivate the Booktics plugin via WP-CLI
wp plugin deactivate booktics
wp plugin status booktics
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
