# CVE-2026-39585: Arraytics Booktics missing authorization in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-39585-arraytics-booktics-missing-authorization-in-wordpress-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39585 · Severity: medium · CVSS 5.3 · Published 2026-04-08

Arraytics Booktics, a WordPress plugin used for booking and scheduling, contains a security flaw where it fails to properly check user permissions. This could allow an unauthorized person to access information or perform actions that should be restricted to administrators. Organizations using this plugin should update to the latest version to prevent unauthorized access to their booking system.

Technologies: [Arraytics Booktics](https://junglewise.ai/threats/technologies/booktics). Vendors: [Arraytics](https://junglewise.ai/threats/vendors/arraytics).

## Quick answers

**Is CVE-2026-39585 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39585 being exploited in the wild.

**How severe is CVE-2026-39585?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** Arraytics Booktics <= 1.0.16, n/a through 1.0.16.

**Is there a fix for CVE-2026-39585?** A patch was published on 2026-06-17: Patchstack confirmed version 1.0.17 as the patched version Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39585 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-39585?** Check whether you run Arraytics Booktics at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authorization vulnerability (CWE-862) exists in the Arraytics Booktics plugin for WordPress up to version 1.0.16. The flaw stems from incorrectly configured access control security levels, which fail to validate user permissions before executing certain functions. An unauthenticated remote attacker can exploit this to bypass intended access restrictions and potentially view sensitive data or modify settings. The issue is resolved in version 1.0.17.

## Affected products

- Arraytics Booktics n/a through 1.0.16

## Timeline

- 2026-01-03: disclosed: Reported by Simone Maion to Patchstack
- 2026-02-02: advisory: Patchstack published the vulnerability details
- 2026-04-08: advisory: NVD published the CVE record
- 2026-06-17: patched: Patchstack confirmed version 1.0.17 as the patched version

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-16-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-16-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Arraytics Booktics missing authorization in access control](https://junglewise.ai/threats/cve-2026-62122-missing-authorization-vulnerability-in-arraytics-booktics)
- [Arraytics Booktics broken access control in pages](https://junglewise.ai/threats/cve-2026-104674-missing-authorization-vulnerability-in-arraytics-booktics)
- [Arraytics Booktics broken access control vulnerability](https://junglewise.ai/threats/cve-2026-112829-missing-authorization-vulnerability-in-arraytics-booktics)
- [Arraytics Booktics DOM-based cross-site scripting](https://junglewise.ai/threats/cve-2026-109895-improper-neutralization-of-input-during-web-page-generation)
- [Arraytics Booktics SQL injection](https://junglewise.ai/threats/cve-2026-109894-improper-neutralization-of-special-elements-used-in-an-sql)