PT-2026-24175 · WordPress · Booktics

Kazuma Matsumoto · Published 2026-03-10 · Updated 2026-03-10 · CVE-2026-1920

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.17

Description The Booktics plugin for WordPress has a flaw that allows unauthorized modification of data. This is due to a missing capability check within the Extension Controller::update item permissions check function. An unauthenticated attacker can exploit this to install addon plugins.

Recommendations Update the Booktics plugin to version 1.0.17 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-1920

Affected Products

Booktics

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-1920 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/ab051f4a-030a-44aa-8cbf-665c6c6d31a7?source=cve · Note
• https://plugins.trac.wordpress.org/browser/booktics/tags/1.0.15/core/extensions/controllers/extension-controller.php#L110 · Note
• https://t.me/cveNotify/154949 · Telegram Post
• https://twitter.com/CVEnew/status/2031294578079445261 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3477898/booktics/trunk/core/extensions/controllers/extension-controller.php · Note
• https://twitter.com/VulmonFeeds/status/2031507489053655147 · Twitter Post
• https://t.me/CVEtracker/46974 · Telegram Post