WordPress Booktics Plugin Data Exposure Vulnerability

A vulnerability in the Booking Calendar for Appointments and Service Businesses - Booktics plugin for WordPress allows unauthorized data access. This issue arises from a lack of proper capability checks on several REST API endpoints, affecting all versions up to and including 1.0.16. As a result, unauthenticated attackers can retrieve sensitive information.

Impact

Exploitation of this vulnerability could lead to unauthorized access to sensitive data, such as customer information and appointment details.

Reproduction

The vulnerability can be reproduced by sending a request to the affected REST API endpoints without authentication. The missing capability checks allow for the unauthorized retrieval of sensitive data.

Remediation

Users are advised to update the Booktics plugin to version 1.0.17 or later, where this vulnerability has been addressed.