CVE-2026-11446 describes a missing authorization vulnerability (CWE-862) in the Booktics – Appointment Booking Calendar for Service Businesses WordPress plugin. The vulnerability exists because the create_order_permission() callback on the POST /wp-json/booktics/v1/orders REST route always returns true, allowing unauthenticated access. Additionally, the find_and_update_guest() function overwrites an existing customer's stored name, phone, and wp_user_id when the supplied email matches, without verifying ownership. This combination permits attackers to overwrite contact details of any customer by supplying their email address, leading to data poisoning in reminders, SMS, calendar invites, and CRM systems.

An unauthenticated attacker can overwrite the contact details (name, phone, wp_user_id) of any existing customer record if they know the customer's email address. This does not allow confidentiality breaches or denial of service but can poison downstream systems that rely on accurate contact information, such as reminder emails, SMS notifications, calendar invites, and CRM data integrity.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable REST endpoint if possible and monitor for suspicious activity involving customer data updates.