CVE-2026-104390

Executive Summary

CVE-2026-104390 is a missing authorization vulnerability (CWE-862) in the Arraytics Booktics WordPress plugin, affecting versions through 1.0.27. An authenticated attacker with low privileges can exploit incorrectly configured access control security levels to bypass authorization checks and read data they should not have access to. With a CVSS base score of 4.3, the impact is limited to confidentiality (C:L) with no integrity or availability impact, but the flaw remains unpatched and requires no user interaction, making it a viable target for opportunistic exploitation in multi-user WordPress environments.

Technical Analysis

The vulnerability is classified under CWE-862: Missing Authorization. According to the NVD description, the flaw stems from "Exploiting Incorrectly Configured Access Control Security Levels" within the Booktics plugin, affecting versions from n/a through 1.0.27. This indicates that one or more plugin functions or endpoints fail to perform an authorization check before granting access to protected resources or data.

In a WordPress context, missing authorization typically manifests when a plugin registers an AJAX action, REST API route, or admin-post handler without a proper capability check (e.g., current_user_can()) or without validating a nonce. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms that the attack is network-accessible, requires low privileges (an authenticated user, such as a subscriber), needs no user interaction, and results in a low confidentiality impact only. The scope is unchanged, meaning the vulnerable component does not affect resources beyond its security authority.

Because the CVSS vector includes PR:L, the attacker must possess some level of authentication — likely a standard WordPress account with subscriber-level or similar low privileges. The C:L rating indicates that the exposed data is limited in scope or sensitivity, but could still include booking records, customer details, or plugin configuration data. No specific function names, endpoints, or parameter names are provided in the available intelligence, so the exact vulnerable code path cannot be identified from public data. The vulnerability class is well understood: an authenticated user can invoke a plugin action that lacks proper permission validation and retrieve data that should be restricted to higher-privileged roles.

The AC:L rating (Low attack complexity) and UI:N (No user interaction) suggest that exploitation is straightforward once the attacker has a valid low-privileged account. No public proof-of-concept or Nuclei template is available, and no exploit code has been observed in the wild as of this reporting.

Exploitation Scenarios

No public PoC is available; the attack chain described below is inferred from the vulnerability class (CWE-862) and the CVSS vector.

1. Reconnaissance and target identification: An attacker identifies a WordPress site running the Booktics plugin version 1.0.27 or earlier. This can be done by inspecting publicly accessible plugin assets (e.g., /wp-content/plugins/booktics/ directory listing, readme files, or version-specific JavaScript/CSS query strings) or by using Shodan dorks such as http.html:"booktics" or product:"Booktics".

2. Prerequisite — authenticated low-privileged access: The attacker registers a new account on the target WordPress site or compromises an existing low-privileged account (subscriber, customer, or similar). The CVSS vector requires PR:L, confirming that authentication is mandatory but the required privilege level is low.

3. Triggering the missing authorization flaw: Once authenticated, the attacker sends crafted requests to the plugin's vulnerable endpoint or action. The specific endpoint is not disclosed in the available intelligence, but in the context of CWE-862, the attacker would target an AJAX action (e.g., via admin-ajax.php with an action parameter), a REST API route, or a direct plugin PHP script. The request would omit or manipulate authorization parameters — or simply rely on the absence of a capability check — to access data that should be restricted. No specific parameter names can be provided without fabrication.

4. Post-exploitation impact: Successful exploitation allows the attacker to read data that is normally restricted to higher-privileged users. Given the C:L rating, the exposed information is limited in scope but may include booking details, customer records, or plugin-specific configuration. There is no integrity or availability impact, so the attacker cannot modify or delete data through this vulnerability alone.

No public exploit code, Nuclei template, or in-the-wild exploitation evidence is available. The absence of a PoC reduces the immediate likelihood of mass exploitation, but the low complexity and lack of a patch warrant proactive monitoring.

Impact Assessment

The CVSS 3.1 base score is 4.3 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. The subscores break down as follows:

• Confidentiality (C:L): Low impact. The attacker can access a limited set of data that is not properly protected by authorization checks. This may include booking information, customer names, or other data stored by the Booktics plugin, depending on the specific vulnerable endpoint.
• Integrity (I:N): No impact. The attacker cannot modify or delete data through this vulnerability.
• Availability (A:N): No impact. The vulnerability does not affect the availability of the system or plugin.
• Scope (S:U): Unchanged. The impact is confined to the vulnerable component.
• Attack Vector (AV:N): Network. The vulnerability can be exploited remotely.
• Attack Complexity (AC:L): Low. No special conditions or race conditions are required.
• Privileges Required (PR:L): Low. The attacker must have a valid low-privileged account.
• User Interaction (UI:N): None. The attacker does not need to trick a victim into performing an action.

The blast radius is limited to WordPress sites running the Booktics plugin versions through 1.0.27. Because the plugin is likely used for booking and reservation management, the exposed data may include personally identifiable information (PII) such as customer names, contact details, and booking histories. While the confidentiality impact is rated Low, any exposure of PII can have regulatory and reputational consequences, particularly under GDPR or similar frameworks. The lack of a patch increases the risk of exploitation over time, especially if the vulnerability becomes publicly known and PoC code is developed.

Detection Guidance

Sigma Rule

title: Booktics Missing Authorization Attempt
id: 7a3f9c2e-1b4d-4e8a-9c7f-2d5e8a1b3c4f
status: experimental
description: Detects potential exploitation of CVE-2026-104390 in the Booktics WordPress plugin, where an authenticated low-privileged user attempts to access restricted plugin actions.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104390
author: Threat Intelligence Team
date: 2026-01-01
tags:
  - attack.t1078
  - cve.2026.104390
logsource:
  category: webserver
  product: apache
  service: access_combined
detection:
  selection_endpoint:
    cs-uri-stem|contains:
      - '/wp-admin/admin-ajax.php'
      - '/wp-json/booktics'
      - '/wp-content/plugins/booktics/'
  selection_params:
    cs-uri-query|contains:
      - 'action='
  selection_status:
    sc-status:
      - 200
      - 403
  condition: selection_endpoint and selection_params and selection_status
falsepositives:
  - Legitimate plugin functionality by authorized users
  - Automated plugin updates or health checks
level: low

YARA Rule

rule CVE_2026_104390_Booktics_Missing_Auth
{
    meta:
        description = "Detects Booktics plugin files associated with CVE-2026-104390 missing authorization vulnerability"
        author = "Threat Intelligence Team"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104390"
        cve = "CVE-2026-104390"

    strings:
        $plugin_name = "booktics" ascii wide nocase
        $wp_ajax = "wp_ajax_" ascii wide
        $ajax_nopriv = "wp_ajax_nopriv_" ascii wide
        $current_user_can = "current_user_can" ascii wide
        $check_ajax_referer = "check_ajax_referer" ascii wide
        $nonce = "wp_verify_nonce" ascii wide
        $version = "1.0.27" ascii wide

    condition:
        $plugin_name and
        (any of ($wp_ajax*) or $ajax_nopriv) and
        not any of ($current_user_can, $check_ajax_referer, $nonce)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-104390 Booktics Missing Authorization Attempt"; flow:established,to_server; http.uri; content:"/wp-admin/admin-ajax.php"; http.uri; content:"action="; http.uri; content:"booktics"; nocase; http.method; content:"POST"; reference:cve,2026-104390; classtype:attempted-recon; sid:2026104390; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and
   url.path : "/wp-admin/admin-ajax.php" and
   url.query : "*action=*" and
   url.query : "*booktics*" and
   http.request.method == "POST"]
  [network where network.protocol == "http" and
   http.response.status_code == 200 and
   url.path : "/wp-admin/admin-ajax.php"]

Splunk SPL Query

index=web_logs sourcetype=access_combined
| search uri_path="/wp-admin/admin-ajax.php" uri_query="*booktics*" status=200
| eval user=coalesce(user, "authenticated")
| stats count by src_ip, uri_query, status, user
| where count > 5
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,booktics,">
  <rule id="2026104" level="8">
    <decoded_as>web</decoded_as>
    <match>/wp-admin/admin-ajax.php</match>
    <regex>action=.*booktics</regex>
    <description>CVE-2026-104390: Possible Booktics plugin missing authorization exploitation attempt detected.</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_104390,</group>
  </rule>

  <rule id="2026105" level="10">
    <if_sid>2026104</if_sid>
    <match>status=200</match>
    <description>CVE-2026-104390: Successful Booktics missing authorization exploitation attempt (HTTP 200).</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>cve_2026_104390,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations:

   • Restrict access to the Booktics plugin's administrative and AJAX endpoints to trusted IP addresses or authenticated users with higher privileges where possible.
   • Disable user registration on the WordPress site if the vulnerability requires only low-privileged authenticated access, reducing the attack surface.
   • Audit existing user accounts and remove any unnecessary low-privileged accounts that could be used as a foothold.
   • Deploy virtual patching via a Web Application Firewall (WAF) to block unauthorized access attempts targeting the Booktics plugin endpoints.
   • Consider temporarily disabling the Booktics plugin if it is not business-critical until a patch is available.

2. Patch/upgrade steps:

   • No patch is currently available. Monitor the Arraytics Booktics plugin repository and vendor channels for an official fix.
   • Once a patched version is released, upgrade immediately to the latest version.
   • If a patch is not released in a timely manner, evaluate alternative booking plugins that implement proper authorization controls.

3. Long-term hardening:

   • Enforce the principle of least privilege across all WordPress user roles.
   • Implement role-based access control (RBAC) audits and ensure that plugin developers use current_user_can() and nonce verification for all sensitive actions.
   • Regularly review installed plugins for known vulnerabilities and remove unused or abandoned plugins.
   • Maintain a vulnerability management program that includes prompt patching and vendor communication.

References

• NVD — CVE-2026-104390
• CWE-862: Missing Authorization
• WordPress Plugin Security Guidelines
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-104390 is not listed as of reporting)
• FIRST EPSS (No EPSS score available for this CVE as of reporting)

No threat actor campaigns or exploit-in-the-wild evidence have been observed for CVE-2026-104390 as of this reporting.