CVE-2026-1919 affects the Booktics – Booking Calendar for Appointments and Service Businesses WordPress plugin by arraytics. The vulnerability arises from missing capability checks on multiple REST API endpoints, allowing unauthenticated users to query sensitive data. This issue impacts all versions up to and including 1.0.16. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability is categorized under CWE-306, indicating a failure to enforce authentication on critical functions.

An attacker can access sensitive data exposed by the plugin's REST API endpoints without authentication. This unauthorized data disclosure could lead to privacy violations or information leakage. There is no indication of impact on data integrity or availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix is currently available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the REST API endpoints or disabling the plugin if feasible to prevent unauthorized data access.