SQL Injection Vulnerability in Arraytics Booktics by Arraytics
CVE-2026-109894

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Booktics
Vendor
CVE Published:
18 October 2026

What is CVE-2026-109894?

An SQL Injection vulnerability in the Arraytics Booktics plugin can allow attackers to manipulate database queries executed by the application. This flaw affects all versions of Booktics up to 1.0.29, enabling unauthorized access to sensitive data. It is critical for users to apply updates or patches to mitigate potential risks and enhance the security of their application.

Affected Version(s)

Booktics 0 <= 1.0.29

References

https://patchstack.com/database/wordpress/plugin/booktics...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

dzaku | Patchstack Bug Bounty Program
.