CVE-2026-109894

Arraytics Booktics

Published 18 Oct 2026 · updated 18 Oct 2026 · Received

9.3 Critical · CVSS 3.1, patchstack.com

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.

References

patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability?_s_id=cve