CVE-2026-1920 identifies a missing authentication vulnerability (CWE-306) in the Booktics – Booking Calendar for Appointments and Service Businesses WordPress plugin by arraytics. Specifically, the 'Extension_Controller::update_item_permissions_check' function lacks a capability check, enabling unauthenticated attackers to modify data by installing addon plugins. This affects all versions up to 1.0.16. The vulnerability is remotely exploitable without privileges or user interaction, with a medium impact on integrity but no impact on confidentiality or availability.

An unauthenticated attacker can exploit this vulnerability to install addon plugins within the affected Booktics plugin, leading to unauthorized modification of data. This compromises the integrity of the system but does not affect confidentiality or availability according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the plugin's administrative functions and monitor for suspicious activity related to addon installations. Avoid installing untrusted addons and maintain regular backups.