The Booktics plugin for WordPress contains a missing authorization flaw that allows attackers to exploit incorrectly configured access control security levels. Because the plugin does not check sufficient permissions, an attacker can access and potentially modify or delete book entries stored by the plugin. This breach of authorization can expose sensitive data or compromise the integrity of the site’s content.

The vulnerability affects the Arraytics Booktics WordPress plugin in all releases up to and including version 1.0.28. Any WordPress site that has an affected version of the plugin installed is at risk, regardless of the site’s role or configuration, unless the plugin is removed or upgraded.

The CVSS score of 5.3 rates this as a moderate impact vulnerability, and it is not listed in the CISA KEV catalog. The EPSS score is not reported, suggesting limited publicly known exploitation. Attack attempts would likely be carried out through the plugin’s exposed HTTP endpoints, sending requests that bypass normal role checks. Because the flaw is purely an authorization lapse, the exploitation does not require special code execution privileges on the server, making it relatively straightforward for an attacker with network access to the web application.