CVE-2026-11446 arraytics CVE debrief

Who should care

Defenders managing WordPress installations with the Booktics plugin, especially those handling customer information, should assess exposure and prioritize verification and remediation efforts.

Why it matters

CVE-2026-11446 allows unauthenticated attackers to modify customer contact details in the Booktics plugin for WordPress. Defenders should verify exposure, especially for versions up to 1.0.23, and prioritize remediation to prevent data tampering and potential downstream impacts.

• Verification of customer contact information integrity
• Potential modification of customer data by unauthorized parties
• Risk of downstream data poisoning in reminder emails, SMS, calendar invites, and CRM systems
• Need for compensating controls to detect unauthorized changes

Technical summary

The Booktics plugin for WordPress has a vulnerability allowing unauthorized modification of customer data due to inadequate permission checks in the create_order_permission() callback and find_and_update_guest() functions. This issue, present in all versions up to and including 1.0.23, enables unauthenticated attackers to overwrite contact details of existing customers whose email addresses they know, potentially leading to data tampering and downstream impacts in reminder emails, SMS, calendar invites, and CRM systems. Defenders should prioritize verifying exposure of WordPress installations using the Booktics plugin, especially versions up to 1.0.23, and assess the risk of customer contact information being

Defensive priority

Defenders should prioritize verifying exposure of WordPress installations using the Booktics plugin, especially versions up to 1.0.23, and assess the risk of customer contact information being modified by unauthorized parties.

Recommended defensive actions

• Verify WordPress installations for the Booktics plugin version 1.0.23 or earlier
• Assess exposure of customer contact information
• Implement compensating controls to monitor for unauthorized modifications
• Review and update the plugin to a patched version if available
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. Details are provided by Wordfence security researchers. However, specific versions affected beyond 1.0.23 and exact remediation steps require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.