CVE-2026-11446
Received Received - Intake

Unauthenticated Data Overwrite in Booktics WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-11446
EUVD
EUVD-2026-75936

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
booktics booking_calendar_for_appointments_and_service_businesses to 1.0.23 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Booktics plugin for WordPress has a flaw allowing unauthorized modification of customer data. An unauthenticated attacker can change a customer's name, phone number, and linked user ID by exploiting a flawed permission check and email-based record update mechanism.

Detection Guidance

Check WordPress sites using the Booktics plugin for unauthorized changes to customer contact details via the /wp-json/booktics/v1/orders REST route. Monitor logs for POST requests to this endpoint with mismatched email ownership.

Impact Analysis

Attackers could overwrite customer contact details, causing incorrect reminders, SMS, calendar invites, and CRM data. This could lead to missed appointments, miscommunication, or data corruption for affected customers.

Compliance Impact

This vulnerability may violate GDPR by exposing personal data to unauthorized changes and HIPAA by compromising customer contact information integrity. Compliance requires ensuring data accuracy and protection against unauthorized modifications.

Mitigation Strategies

Update the Booktics plugin to the latest version beyond 1.0.23. If unavailable, disable the plugin temporarily. Restrict access to the /wp-json/booktics/v1/orders endpoint via firewall rules or .htaccess.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-11446. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart