CVE-2026-1919: WordPress Booktics Auth Bypass Vulnerability

CVE-2026-1919 Overview

The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress contains a critical authorization vulnerability due to missing capability checks on multiple REST API endpoints. This vulnerability affects all versions up to and including 1.0.16, allowing unauthenticated attackers to access sensitive data through unprotected API endpoints.

Critical Impact

Unauthenticated attackers can query sensitive customer, appointment, order, and team member data through exposed REST API endpoints without any authentication or authorization checks.

Affected Products

• Booktics WordPress Plugin versions ≤ 1.0.16
• WordPress sites using the Booking Calendar for Appointments and Service Businesses plugin
• All configurations with default REST API endpoint exposure

Discovery Timeline

• 2026-03-10 - CVE CVE-2026-1919 published to NVD
• 2026-03-11 - Last updated in NVD database

Technical Details for CVE-2026-1919

Vulnerability Analysis

This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), a broken access control issue that allows unauthorized data access. The Booktics plugin fails to implement proper capability checks on several REST API controller endpoints, enabling unauthenticated users to retrieve sensitive business and customer information.

The vulnerability spans multiple core components of the plugin, including the appointment controller, customer controller, order controller, and team member controller. Each of these controllers exposes REST API endpoints that handle sensitive data operations without verifying whether the requesting user has appropriate permissions.

For WordPress plugin development, proper capability checks using functions like current_user_can() should be implemented before processing any requests that access or modify sensitive data. The absence of these checks means that any external party can enumerate and extract data intended only for authenticated administrators.

Root Cause

The root cause is a missing authorization check (CWE-306) in the plugin's REST API endpoint handlers. The affected controllers process data requests without validating the user's capabilities or authentication status. This is a common vulnerability pattern in WordPress plugins where developers register REST routes but fail to implement the permission_callback parameter or implement it incorrectly.

Affected controller files include:

• core/appointment/controllers/appointment-controller.php (line 549)
• core/customer/controllers/customer-controller.php (line 229)
• core/order/controllers/order-controller.php (line 889)
• core/team-member/controllers/team-member-controller.php (line 235)

Attack Vector

The attack vector is network-based and requires no user interaction or authentication. An attacker can directly access the vulnerable REST API endpoints from any network location. The exploitation is straightforward:

1. Attacker identifies a WordPress site running the Booktics plugin
2. Attacker sends crafted HTTP requests to the exposed REST API endpoints
3. The plugin processes these requests without authorization verification
4. Sensitive data including customer information, appointments, orders, and team member details is returned to the attacker

The attack requires no privileges, no user interaction, and has low complexity. The vulnerable endpoints can be discovered through standard WordPress REST API enumeration techniques.

Detection Methods for CVE-2026-1919

Indicators of Compromise

• Unusual volume of REST API requests to /wp-json/ endpoints containing booktics or related appointment/customer paths
• Access logs showing unauthenticated requests to customer, appointment, order, or team-member controller endpoints
• Multiple sequential API requests from unknown IP addresses querying plugin endpoints
• Evidence of data enumeration patterns in access logs targeting the Booktics plugin

Detection Strategies

• Monitor WordPress REST API access logs for requests to Booktics-related endpoints from unauthenticated sessions
• Implement Web Application Firewall (WAF) rules to detect and alert on suspicious patterns targeting /wp-json/booktics/ endpoints
• Review access logs for bulk data extraction attempts or rapid sequential API calls
• Deploy WordPress security plugins that monitor and alert on unauthorized REST API access attempts

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests, including authentication status
• Configure alerts for high-frequency API requests to sensitive plugin endpoints
• Implement rate limiting on REST API endpoints to slow potential data exfiltration
• Regularly audit plugin endpoint permissions using WordPress security scanning tools

How to Mitigate CVE-2026-1919

Immediate Actions Required

• Update the Booktics plugin to a version newer than 1.0.16 that includes the security fix
• If immediate update is not possible, temporarily disable the Booktics plugin until patching is complete
• Review access logs for signs of exploitation and potential data breach
• Notify affected customers if evidence of unauthorized data access is discovered

Patch Information

The vulnerability has been addressed in WordPress Changeset #3477898. Site administrators should update to the latest version of the Booktics plugin immediately. The patch implements proper capability checks on the affected REST API endpoints to ensure only authorized users can access sensitive data.

For additional technical details and vulnerability analysis, refer to the Wordfence Vulnerability Analysis.

Workarounds

• Implement a Web Application Firewall (WAF) rule to block unauthenticated access to Booktics REST API endpoints
• Use WordPress .htaccess rules to restrict access to REST API endpoints from trusted IP addresses only
• Temporarily disable the REST API for the Booktics plugin using a security plugin if update is not immediately possible
• Consider using a WordPress security plugin that enforces authentication on all REST API requests

# Temporary .htaccess restriction for Booktics REST API endpoints
# Add to WordPress root .htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_URI} ^/wp-json/booktics/ [NC]
RewriteCond %{HTTP:Authorization} ^$
RewriteRule ^(.*)$ - [F,L]
</IfModule>