{"id":"CVE-2026-109894","published":"2026-10-18T11:16:36.190","lastModified":"2026-10-18T11:16:36.190","description":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics booktics allows SQL Injection.This issue affects Booktics: from n/a through 1.0.29.","cvssScore":9.3,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:L","cwes":["CWE-89"],"vendors":[],"products":[],"references":[{"url":"https://patchstack.com/database/wordpress/plugin/booktics/vulnerability/wordpress-booktics-plugin-1-0-29-sql-injection-vulnerability?_s_id=cve","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This SQL injection vulnerability in Booktics allows attackers to execute arbitrary SQL commands against the database without authentication, potentially leading to data exposure and manipulation. The flaw occurs when user input is not properly sanitized before being included in SQL queries.","exploitability":"Exploitation is straightforward with no authentication required, needing only network access to the vulnerable application to inject malicious SQL payloads into database queries.","blast_radius":"If exploited, attackers could access and modify sensitive book inventory data, user information, and potentially escalate to full database compromise across all affected versions through 1.0.29.","remediation":"Upgrade to version 1.0.30 or later to remediate this SQL injection vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["sql-injection","database","web","unauthenticated"],"model":"garnet-coder","analyzedAt":"2026-10-18T15:47:00.603Z"}}