CVE-2026-28002

Name of the Vulnerable Software and Affected Versions Booktics versions prior to 1.0.23

Description An SQL Injection flaw exists in the Booktics plugin for WordPress. Authenticated attackers with subscriber-level access or higher can append additional SQL queries to existing ones due to insufficient escaping of user-supplied parameters and a lack of proper preparation of the SQL query. This allows for Blind SQL Injection, which can be used to extract sensitive information from the database.

Recommendations Update to a version newer than 1.0.22.