CVE case study
CVE-2026-28002: Subscriber SQL Injection in the Booktics Plugin
A subscriber-level SQL injection flaw in the Booktics plugin 1.0.22 let a low-privileged account send crafted input into a database query. Version 1.0.23 parameterizes the affected query.
- Weakness
- SQL Injection
- Affected
- Booktics 1.0.22
- Remediation state
- Upgrade to Booktics 1.0.23 or later
- Advisory published
- 12 Aug 2026
Why it matters
Booktics is a WordPress booking plugin. In version 1.0.22, a subscriber-level SQL injection let a low-privileged account place crafted input into a database query.
SQL injection can read or alter data the query can reach. The public record scores this High at 8.5; version 1.0.23 parameterizes the affected query.