CVE-2026-11446: Booktics WordPress Plugin Auth Bypass Flaw

CVE-2026-11446 Overview

The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress contains a missing authorization flaw [CWE-862] affecting all versions up to and including 1.0.23. The create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returns true, and the find_and_update_guest() function overwrites an existing customer's stored name, phone, and wp_user_id whenever a caller-supplied email matches an existing record. Unauthenticated attackers who know a customer's email address can overwrite their contact details, poisoning downstream reminder emails, SMS notifications, calendar invites, and CRM data.

Critical Impact

Unauthenticated attackers can silently rewrite the name and phone number of any customer whose email address is known, corrupting booking workflows and downstream communications.

Affected Products

• Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress
• All versions up to and including 1.0.23
• Deployments exposing the /wp-json/booktics/v1/orders REST endpoint

Discovery Timeline

• 2026-09-11 - CVE-2026-11446 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-11446

Vulnerability Analysis

The flaw is a broken access control issue in the Booktics REST API. The POST /wp-json/booktics/v1/orders route is guarded by create_order_permission(), which returns true for every request regardless of authentication state or capability. This exposes the guest-order creation path to any anonymous client on the network.

During order handling, find_and_update_guest() looks up an existing customer record by the email address supplied in the request body. If a match is found, the function overwrites the stored name, phone, and wp_user_id fields with attacker-supplied values. The plugin performs no ownership check, no email verification, and no rate limiting on this update path.

The result is a silent data integrity violation. Downstream systems that trust the booking database, including reminder emails, SMS messages, calendar invites, and synchronized customer relationship management (CRM) records, propagate the attacker-controlled values.

Root Cause

Two defects combine to produce the vulnerability. First, the REST permission callback is a stub that grants access to all callers. Second, the guest-update logic treats a matching email as sufficient proof of identity and blindly writes new attribute values. Neither layer enforces authorization, matching the [CWE-862] Missing Authorization pattern.

Attack Vector

The attack is remote, network-based, and requires no authentication or user interaction. An attacker sends a crafted POST request to /wp-json/booktics/v1/orders containing a known customer email along with attacker-chosen name and phone values. The plugin updates the corresponding customer record on receipt. Email addresses may be harvested from public-facing sources such as staff pages, review sites, or prior data leaks.

See the annotated source at WordPress Booktics Order Controller Line 172 and WordPress Booktics Order Controller Line 885 for the vulnerable permission callback and guest-update logic.

Detection Methods for CVE-2026-11446

Indicators of Compromise

• Unexpected changes to customer name or phone fields in the Booktics database without a corresponding admin action or authenticated user session.
• Web server access logs showing POST requests to /wp-json/booktics/v1/orders from unauthenticated clients or unusual IP ranges.
• Customer complaints about incorrect names on reminder emails, SMS, or calendar invites.

Detection Strategies

• Inspect WordPress REST traffic for anonymous POST requests to the Booktics orders route and correlate against the source IP reputation.
• Enable database auditing on the Booktics customer tables to record every write to the name, phone, and wp_user_id columns.
• Compare current customer records against periodic backups to identify unauthorized modifications.

Monitoring Recommendations

• Alert on high-frequency POST traffic to /wp-json/booktics/v1/orders from a single source, which may indicate enumeration of harvested email lists.
• Forward WordPress and web server logs to a centralized platform for retention and correlation with other integrity signals.
• Track outbound reminder email and SMS delivery failures, which can indicate that attacker-supplied phone numbers or names have been persisted.

How to Mitigate CVE-2026-11446

Immediate Actions Required

• Update the Booktics plugin to a version later than 1.0.23 once the vendor publishes a fix.
• Restrict access to /wp-json/booktics/v1/orders at the web application firewall (WAF) or reverse proxy layer until a patched release is deployed.
• Audit the Booktics customer table for unauthorized name or phone changes and restore known-good values from backup.

Patch Information

At the time of NVD publication on 2026-09-11, all versions through 1.0.23 are affected. Refer to the Wordfence Vulnerability Report for the current fixed version and the vendor's release notes. The vulnerable code paths are documented in the WordPress plugin repository.

Workarounds

• Block or rate-limit unauthenticated POST requests to the /wp-json/booktics/v1/orders REST route at the WAF.
• Disable the Booktics plugin on production sites until an updated version is installed.
• Require email verification or a signed booking token as an additional application-layer control before trusting guest-supplied customer updates.

# Example NGINX rule to block anonymous POSTs to the vulnerable route
location = /wp-json/booktics/v1/orders {
    limit_except GET { deny all; }
}