The Booktics plugin for WordPress fails to perform a capability check in the Extension_Controller::update_item_permissions_check function. This oversight allows any user that can reach the plugin's update endpoint to install addon plugins without authentication. Directing the endpoint to malicious addons could compromise the integrity of the WordPress site, leading to unauthorized data modifications or plugin execution.

The issue affects all installations of the Booktics plugin version 1.0.16 or earlier, as distributed by Arraytics. WordPress sites using these plugin versions are vulnerable regardless of their site configuration, hosting environment, or active management plugins.

The CVSS base score is 5.3, indicating a moderate risk. The EPSS score is below 1%, implying a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can communicate with the plugin’s update endpoint, which is generally available via the REST API or admin interface. Attackers do not need prior privileges, so once the endpoint is reachable, the flaw can be abused without further compromise.