Critical SQL Injection Vulnerability in Arraytics Booktics Plugin

CVE-2026-109894 is a critical SQL injection vulnerability identified in the Arraytics Booktics booking plugin for WordPress. The flaw exists due to improper neutralization of special elements used in SQL commands, which allows an attacker to manipulate back-end database queries. This vulnerability affects all versions of the Booktics plugin from inception through version 1.0.29. Given the nature of SQL injection, an unauthenticated attacker could potentially extract sensitive data, modify database records, or in some configurations, interact with the underlying server environment. Defenders should prioritize updating to a patched version or disabling the plugin until a secure update is verified.

Impact

The vulnerability poses a severe risk to websites utilizing the Booktics plugin. Successful exploitation could lead to unauthorized access to booking data, customer information, and potentially lead to a full compromise of the database integrity. Organizations in the retail, hospitality, or professional services sectors that rely on this plugin for scheduling are at the highest risk of information exfiltration.

Recommendation

• Immediately update the Arraytics Booktics plugin to a version beyond 1.0.29 to remediate CVE-2026-109894.
• Audit database logs for unusual SQL syntax or unexpected query patterns originating from web application request logs.
• Implement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads targeting WordPress plugin endpoints.