Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

Booktics plugin lets attackers run database commands

CVE-2026-109894 · published today
Summary

The Booktics plugin for WordPress (versions up to 1.0.29) can be tricked into executing malicious database queries. This could let an attacker view, change, or delete your site’s data. Update to a newer version of the plugin or remove it if you cannot upgrade.

What to do
  • Update arraytics booktics to version 1.0.30.
Affected software
VendorProductAffected versions
arraytics booktics <= 1.0.29
Fix: upgrade to 1.0.30
Original advisory text
WordPress Booktics plugin <= 1.0.29 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
9.3 Critical
Type
CWE-89SQL Injection
Timeline
Published18 Oct 2026
Updated18 Oct 2026
First seen18 Oct 2026
Sources
CVE-2026-109894 · NVD
CVE-2026-109894 · MITRE
Track software like this
Free during beta