Overview
A critical SQL injection vulnerability has been disclosed in Booktics, a booking/scheduling plugin for WordPress built by Arraytics. Tracked as CVE-2026-109894 with a CVSS score of 9.3, the flaw lets an unauthenticated attacker inject arbitrary SQL through improperly neutralized input, exposing the full WordPress database to unauthorized reads and writes.
A second, lower-severity issue (CVE-2026-109895, a DOM-based XSS flaw scored 7.1) was disclosed in the same version range — sites patching for the SQL injection bug should confirm both are resolved by whatever update they apply.
Technical Details
| Field | Value |
|---|---|
| CVE ID | CVE-2026-109894 |
| Severity | Critical (CVSS 9.3) |
| CWE | CWE-89 — SQL Injection |
| Attack Vector | Network |
| Authentication | None Required |
| Privileges Required | None |
| User Interaction | None |
| Impact | Unauthorized database read/write access |
| Affected Versions | Booktics through 1.0.29 |
| Fixed Version | 1.0.30 |
How It Works
Booktics constructs SQL queries using input that originates from an external, attacker-influenced source — most likely booking form fields or query parameters used by its scheduling interface — without properly neutralizing special characters that have meaning in SQL syntax. Because the affected code path does not require authentication, an attacker can submit crafted input directly to the vulnerable parameter and alter the structure of the underlying SQL command, a textbook CWE-89 condition.
No public proof-of-concept has been released, and the vendor advisory (via Patchstack) has not published the specific vulnerable endpoint or parameter. The CVSS vector indicates a network-exploitable, low-complexity attack that needs no credentials and no user interaction — the kind of flaw automated WordPress plugin scanners tend to pick up and weaponize quickly once technical details leak.
Impact Assessment
Who Is At Risk
Any WordPress site running Booktics 1.0.29 or earlier is affected, including sites that:
- Use Booktics to accept customer bookings or appointment requests from the public web
- Store customer PII (names, emails, phone numbers, payment references) in the same database tables Booktics queries
- Have not yet applied the 1.0.30 update
Potential Attack Chains
- Unauthenticated Submission — Attacker submits a crafted booking request or query containing SQL metacharacters
- Query Manipulation — The unsanitized input alters the intended SQL command executed against the WordPress database
- Data Exfiltration — Attacker extracts customer records, WordPress user credential hashes, or other sensitive table contents
- Further Compromise — Extracted admin password hashes or session data can be cracked or replayed to gain full site access
Mitigation
Immediate Actions
- Update Booktics to version 1.0.30 or later immediately — this is the confirmed fixed release
- If immediate updating isn't possible, take the booking form offline or place it behind authentication until the update is applied
- Audit your database for signs of unusual queries or unexpected data access in logs covering the period before patching
Detection Opportunities
- Review web server and database query logs for booking-related requests containing SQL syntax (
UNION,SELECT, quote characters, comment sequences like--or/*) - Look for anomalous spikes in requests to Booktics-related form endpoints
- Check for unexpected new WordPress administrator accounts, which can indicate a successful chained compromise following data exfiltration
Defence-in-Depth
- Run a WAF with rules that detect and block common SQL injection payloads as a stopgap ahead of patching
- Apply least-privilege database credentials to the WordPress install so a successful injection has a smaller blast radius
- Keep an up-to-date plugin inventory so newly disclosed CVEs in booking, forms, and e-commerce plugins — common SQLi targets — can be triaged quickly
Discovery & Disclosure
CVE-2026-109894 was published on October 18, 2026, with the advisory assigned by Patchstack. As of publication, it is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog and no public exploit is known, but the unauthenticated, zero-interaction attack path against a plugin that directly handles customer data makes prompt patching a priority rather than a "when convenient" task.