The Booking Calendar for Appointments and Service Businesses – Booktics plugin for WordPress has a missing capability check on multiple REST API endpoints in all versions up to 1.0.16, which allows an unauthenticated attacker to query sensitive data. This results in a confidentiality breach, potentially exposing customer information, appointments, orders, and team member details. The vulnerability corresponds to CWE-306, indicating a lack of proper authorization checks.

All published releases of the Booktics plugin for WordPress, from the initial release through version 1.0.16, are affected. The issue resides in various REST API controllers such as appointment, customer, order, and team member endpoints.

The CVSS score of 5.3 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. Attackers can reach the affected endpoints over the network and perform unauthenticated GET requests, without needing elevated privileges or additional credentials. The lack of an authentication guard makes exploitation straightforward, but its visibility and impact remain limited to data confidentiality.