CVE-2026-1920: 
WordPress vulnerability analysis and mitigation

CVE-2026-1920 is a missing authorization vulnerability in the Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress. Due to a missing capability check on the Extension_Controller::update_item_permissions_check function, unauthenticated attackers can install arbitrary addon plugins on affected sites. All versions up to and including 1.0.16 are affected. The vulnerability was published on March 10, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function) and estimated as CWE-862 (Missing Authorization). The vulnerable function Extension_Controller::update_item_permissions_check in the plugin's extension controller fails to verify whether the requesting user has the necessary WordPress capabilities before allowing addon plugin installation. Because no authentication or privilege check is enforced, any unauthenticated network request can trigger this endpoint. The vulnerable code path is visible in the plugin's source at version 1.0.15 and was patched in changeset 3477898 (WordPress Trac (source), WordPress Trac (patch)).

Successful exploitation allows an unauthenticated remote attacker to install arbitrary addon plugins on the WordPress site, resulting in unauthorized modification of site data and functionality. Depending on the addon installed, this could lead to further compromise including code execution, backdoor installation, or privilege escalation, potentially enabling full site takeover. Confidentiality and availability impacts are rated as none in isolation, but integrity is degraded, and chained exploitation could significantly expand the attack surface (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.035%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and low complexity, making it straightforward to exploit if targeted (Wordfence, Wordfence Weekly Report).

1. Reconnaissance: Identify WordPress sites running the Booktics plugin (versions ≤ 1.0.16) using tools like WPScan, Shodan, or by checking publicly accessible readme.txt or plugin metadata files.
2. Locate the vulnerable REST API endpoint: Identify the REST API route registered by Extension_Controller that maps to the update_item_permissions_check function — typically accessible via the WordPress REST API (e.g., /wp-json/booktics/v1/extensions/<id>).
3. Craft unauthenticated request: Send an HTTP PUT or POST request to the identified endpoint without any authentication headers or nonce, including a payload specifying the desired addon plugin to install.
4. Install malicious or backdoor addon: Specify a malicious addon plugin URL or identifier in the request body; the server processes the request without verifying user privileges and installs the specified addon.
5. Achieve further compromise: Use the installed addon to execute arbitrary code, create administrative accounts, or establish persistence on the WordPress site (WordPress Trac (source), Wordfence).

• Network: Unexpected unauthenticated HTTP PUT/POST requests to WordPress REST API endpoints under /wp-json/booktics/v1/extensions/ from external IP addresses.
• Logs: WordPress access logs showing REST API calls to Booktics extension endpoints without valid authentication tokens or nonces; PHP error logs referencing Extension_Controller.
• File System: Newly installed or unexpected plugin directories under wp-content/plugins/ not authorized by site administrators; unfamiliar addon plugin files associated with Booktics.
• Database: New entries in the WordPress wp_options table reflecting newly activated plugins or addon configurations not initiated by an admin user.

Update the Booktics plugin to version 1.0.17 or later, which includes the fix applied in changeset 3477898 that adds proper capability checks to the update_item_permissions_check function. If an immediate update is not possible, consider deactivating the plugin until patching is feasible, or restrict access to the WordPress REST API for unauthenticated users via a WAF rule or server-level configuration. Regularly audit installed plugins for unexpected additions (WordPress Trac (patch), Wordfence).

Wordfence disclosed the vulnerability as part of their weekly WordPress vulnerability report for March 9–15, 2026, noting it as a medium-severity missing authorization issue (Wordfence Weekly Report). The CVE was also noted on Bluesky via the CVE feed account and aggregated by several vulnerability tracking services including VulDB, CIRCL, and ENISA's EUVD. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregation.