CVE-2026-1919 is a vulnerability classified under CWE-306 (Missing Authentication for Critical Function) affecting the Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress, developed by arraytics. The flaw exists in all versions up to 1.0.16, where multiple REST API endpoints lack proper capability checks, allowing unauthenticated attackers to query sensitive data without any authentication or authorization. The vulnerability is remotely exploitable over the network without requiring user interaction or privileges, making it accessible to any attacker aware of the endpoints. The exposed data could include booking details, customer information, or other sensitive business data managed by the plugin. The CVSS v3.1 base score is 5.3, reflecting a medium severity due to the confidentiality impact without affecting integrity or availability. No patches or fixes are currently linked, and no known exploits have been reported in the wild as of the publication date. The vulnerability highlights the importance of enforcing authentication and authorization checks on all REST API endpoints in WordPress plugins, especially those handling sensitive business data.

The primary impact of this vulnerability is unauthorized disclosure of sensitive data managed by the Booktics plugin, such as customer appointments, personal information, and business scheduling details. This can lead to privacy violations, reputational damage, and potential regulatory compliance issues for affected organizations. Although the vulnerability does not allow data modification or denial of service, the exposure of confidential information can facilitate further targeted attacks, social engineering, or competitive intelligence gathering. Organizations relying on this plugin for managing appointments and services are at risk of data leakage, which could undermine customer trust and business operations. The ease of exploitation and lack of authentication requirements increase the likelihood of opportunistic scanning and data harvesting by attackers.

To mitigate this vulnerability, organizations should immediately update the Booktics plugin to a version that includes proper capability checks on all REST API endpoints once available. Until a patch is released, administrators should consider disabling the plugin or restricting access to the REST API endpoints via web application firewalls (WAFs) or server-level access controls to block unauthenticated requests. Implementing strict authentication and authorization mechanisms for all API endpoints is critical. Monitoring and logging REST API access patterns can help detect suspicious activity indicative of exploitation attempts. Additionally, organizations should review and minimize the exposure of sensitive data through APIs and apply the principle of least privilege in plugin configurations. Regular security assessments and plugin audits are recommended to identify similar issues proactively.