The vulnerability is a missing authorization issue in the Arraytics Booktics WordPress plugin. It allows users to bypass incorrect access control configurations, potentially letting an attacker perform privileged operations that should be restricted. The weakness falls under the Access Control category and could result in unauthorized disclosure or manipulation of data within the plugin’s scope.

WordPress sites that have the Arraytics Booktics plugin installed with a version up to and including 1.0.31. The issue applies to all installations of the plugin regardless of other components or configurations, and is resolved in version 1.0.32 and later.

The CVSS score of 4.3 indicates a moderate severity, with no exploitation probability score available and it is not listed in CISA’s KEV catalog. The likely attack path is a web‑based vector, where an attacker can target specific URLs or functions exposed by the plugin. The exploit requires ability to send crafted requests, so it can be performed by any user who can reach those endpoints, whether authenticated or not, depending on the plugin’s current access settings.