{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/booktics--1.0.29/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:arraytics:booktics:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.3,"id":"CVE-2026-109894"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Booktics (n/a - 1.0.29)","Booktics (\u003c= 1.0.29)"],"_cs_severities":["critical"],"_cs_tags":["web-application-security","sqli","vulnerability","web-vulnerability","xss","wordpress"],"_cs_type":"advisory","_cs_vendors":["Arraytics"],"content_html":"\u003cp\u003eCVE-2026-109894 is a critical SQL injection vulnerability identified in the Arraytics Booktics booking plugin for WordPress. The flaw exists due to improper neutralization of special elements used in SQL commands, which allows an attacker to manipulate back-end database queries. This vulnerability affects all versions of the Booktics plugin from inception through version 1.0.29. Given the nature of SQL injection, an unauthenticated attacker could potentially extract sensitive data, modify database records, or in some configurations, interact with the underlying server environment. Defenders should prioritize updating to a patched version or disabling the plugin until a secure update is verified.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability poses a severe risk to websites utilizing the Booktics plugin. Successful exploitation could lead to unauthorized access to booking data, customer information, and potentially lead to a full compromise of the database integrity. Organizations in the retail, hospitality, or professional services sectors that rely on this plugin for scheduling are at the highest risk of information exfiltration.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the Arraytics Booktics plugin to a version beyond 1.0.29 to remediate CVE-2026-109894.\u003c/li\u003e\n\u003cli\u003eAudit database logs for unusual SQL syntax or unexpected query patterns originating from web application request logs.\u003c/li\u003e\n\u003cli\u003eImplement Web Application Firewall (WAF) rules to detect and block common SQL injection payloads targeting WordPress plugin endpoints.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-18T11:56:54Z","date_published":"2026-10-18T11:55:18Z","id":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109894-sql-injection/","summary":"CVE-2026-109894 is a critical SQL injection vulnerability in the Arraytics Booktics plugin that allows unauthenticated attackers to execute arbitrary database queries.","title":"Critical SQL Injection Vulnerability in Arraytics Booktics Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-cve-2026-109894-sql-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Booktics (\u003c= 1.0.29)","version":"https://jsonfeed.org/version/1.1"}