Booktics, a WordPress plugin, contains a missing authorization flaw that allows attackers to bypass intended access restrictions. The vulnerability permits operations that should be limited to privileged users, such as modifying or deleting books, and possibly accessing sensitive information stored by the plugin. It represents a CWE-862 weakness that can compromise the integrity of the plugin’s data and the overall content on the site.

The affected product is the Arraytics Booktics plugin for WordPress, versions 1.0.30 and earlier. Any WordPress installation using this plugin within that version range is susceptible, regardless of other security controls.

The CVSS score is 5.3, indicating a moderate severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no known widespread exploitation yet. The most likely attack vector is through the plugin’s exposed endpoints; an attacker with access to the site can send crafted requests to bypass authorization checks. Without remediation, the risk remains that an attacker can alter content or gain higher privileges on the affected WordPress installation.