PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-107418 Arraytics CVE debrief

The CVE-2026-107418 vulnerability affects WordPress Booktics plugin versions up to and including 1.0.28, allowing unauthorized actions due to broken access control, with a CVSS score of 5.4 indicating medium severity. Defenders should verify plugin versions, review access controls, and monitor for unauthorized actions. This issue requires attention as it involves broken access control, potentially leading to unauthorized modifications. The vulnerability was published on October 12, 2026, and last modified on the same day. Limited information is available on exploitation or specific impacts, emphasizing the need for defenders to prioritize verification and enhance access controls.

Vendor
Arraytics
Product
Booktics
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-12
Original CVE updated
2026-10-12
Advisory published
2026-10-12
Advisory updated
2026-10-12

Who should care

Defenders responsible for WordPress installations with the Booktics plugin should assess exposure and prioritize verification of the plugin version in use. They should also review and enhance access controls and authentication mechanisms for the plugin.

Why it matters

The CVE-2026-107418 vulnerability in the WordPress Booktics plugin requires attention from defenders responsible for WordPress installations. It involves broken access control, allowing unauthorized actions, with a medium CVSS score of 5.4. Defenders should verify plugin versions, review access controls, and monitor for unauthorized actions.

  • Defenders need to verify the version of the Booktics plugin to ensure it is not vulnerable.
  • Reviewing and enhancing access controls and authentication mechanisms for the plugin is necessary.
  • Monitoring for unauthorized actions or changes within the plugin is required.

Technical summary

The WordPress Booktics plugin, versions up to and including 1.0.28, is affected by a broken access control vulnerability. This issue allows unauthorized actions to be performed. The vulnerability has a CVSS score of 5.4, indicating a medium severity level.

Defensive priority

Defenders should prioritize verifying the version of the Booktics plugin in use and ensuring it is updated to a version beyond 1.0.28 if available. They should also review access controls and authentication mechanisms for the plugin.

Recommended defensive actions

  • Verify the version of the Booktics plugin in use and update to a version beyond 1.0.28 if available.
  • Review access controls and authentication mechanisms for the plugin.
  • Monitor for any unauthorized actions or changes within the plugin.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and CVSS score. However, there is limited information on exploitation or specific impacts.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-107418 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-107418

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-107418 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-107418

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.