CVE-2026-11446— Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
Quick assessment
Affected
arraytics Booktics – Appointment Booking Calendar for Service Businesses
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WordPress 插件 Booktics – Booking Calendar for Appointments and Service Businesses 在所有 1.0.23 及之前版本中均存在未授权数据修改漏洞。该漏洞的成因如下： REST 路由 中的权限回调函数 无条件返回 ，导致该接口无需身份验证即可访问； 函数 在调用方提供的邮箱与现有客户记录匹配时，会覆盖该客户的姓名、电话和 ，且未要求证明邮箱所有权。 这使得未认证的 attackers 可以通过已知客户的邮箱地址，覆盖其联系信息（姓名和电话），
Possible ATT&CK Techniques 2 AI
T1083 · File and Directory Discovery T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-11446
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Booktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization
Source: CVE Program / CVE List V5
Vulnerability Description
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制缺失
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| arraytics | Booktics – Appointment Booking Calendar for Service Businesses | 0 ~ 1.0.23 | - |
|
II. Public POCs for CVE-2026-11446
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-11446
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-11446 (1)
IV. Related Vulnerabilities
Same vendor: arraytics
-
CVE-2026-15398
Eventin – Event Calendar, Event Registration, Tickets & Book -
CVE-2026-11821
Eventin <= 4.1.17 - Missing Authorization to Authenticated ( -
CVE-2026-15667
Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File -
CVE-2026-15406
Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclu -
CVE-2026-12956
Eventin <= 4.1.22 - Missing Authorization to Unauthenticated
Same weakness: CWE-862
-
CVE-2026-11496
Woo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber -
CVE-2026-18121
Concrete CMS 9.5.2 and below is vulnerable to an authorizati -
CVE-2026-81211
Langflow is vulnerable to arbitrary code execution due to mu -
CVE-2026-89054
OpenNMS missing authorization on /api/v2 PATCH endpoints all -
CVE-2026-88959
Anchor CMS through 0.12.7 Privilege Escalation via Missing A
V. Comments for CVE-2026-11446
No comments yet