Executive brief
Booktics is a WordPress plugin that manages appointment bookings and customer records for service businesses. Attackers can modify customer contact details (name, phone number) of any existing customer by knowing only their email address, without needing authentication. This can poison reminder emails, SMS messages, calendar invites, and CRM systems, disrupting business operations and customer communications.
Technical details
The vulnerability exists in the create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route, which unconditionally returns true, granting unauthorized access. The find_and_update_guest() function then overwrites customer records (name, phone, wp_user_id) when the caller-supplied email matches an existing customer, without verifying ownership or authentication. An unauthenticated attacker can exploit this by crafting a REST API request with a known customer email address and malicious contact details. No authentication or user interaction is required. The vulnerability affects all versions up to and including 1.0.23; patch status is unknown.
Affected products
- Booktics Booking Calendar for Appointments and Service Businesses up to and including 1.0.23
Timeline
- 2026-09-11: disclosed