The Booktics plugin fails to escape special characters in user‑supplied data that is embedded in SQL statements, creating a classic injection flaw. An attacker can craft malicious input to inject arbitrary SQL commands, potentially allowing the reading, modification, or deletion of database contents and, in vulnerable configurations, even executing arbitrary application logic. This weakness is identified as CWE-89.

All releases of the WordPress Booktics plugin made available by Arraytics through version 1.0.29 are susceptible. Sites that host the plugin and expose its booking or reservation functionality are at risk. The vendor issued a patch in version 1.0.30 that removes the vulnerability.

With a CVSS score of 9.3 the problem is rated as critical; no EPSS score is reported, and the issue is not listed in the CISA KEV catalog, but its public availability still presents a high exploitation likelihood. The vulnerability is likely exploitable by sending specially crafted HTTP requests to the plugin’s booking endpoints, as the application accepts and concatenates raw input into SQL queries. Successful exploitation could expose sensitive user data or alter the database state. Immediate remediation is essential to mitigate this severe risk.