Arraytics Booktics Critical SQL Injection CVE-2026-109894 Affects Versions Up to 1.0.29
A critical SQL injection flaw in Arraytics Booktics versions up to 1.0.29 allows attackers to manipulate database queries, according to the National Vulnerability Database.
Key points
- The vulnerability is tracked as CVE-2026-109894 and carries a CVSS score of 9.3.
- It affects all versions of the Booktics plugin from its initial release through 1.0.29.
- The National Vulnerability Database classifies the severity of this issue as critical.
A new security advisory highlights a significant flaw in the Arraytics Booktics WordPress plugin. The National Vulnerability Database has assigned a critical rating to this issue, which involves improper neutralisation of special elements in SQL commands.
What happened
The National Vulnerability Database published a record for CVE-2026-109894, identifying a SQL injection vulnerability within the Arraytics Booktics plugin. This weakness stems from the failure to properly neutralise special characters used in SQL commands. The issue is present in all versions of the software ranging from the initial release up to and including version 1.0.29.
Why it matters
SQL injection flaws are among the most dangerous web application vulnerabilities because they can allow attackers to bypass authentication or extract sensitive data. The National Vulnerability Database assigned a CVSS score of 9.3 to this specific issue, marking it as critical. This high score reflects the potential for significant impact on the confidentiality and integrity of the affected systems.
Next steps
- Review installed versions of the Arraytics Booktics plugin to determine if they are 1.0.29 or earlier.
- Monitor plugin vendor communications for an official patch or update that addresses CVE-2026-109894.
- Ensure that database user accounts for the web application have the minimum necessary permissions.
Detection notes
Security teams should monitor web server logs for unusual SQL syntax or unexpected error messages that may indicate injection attempts. Look for spikes in database query duration or failed login attempts from unusual sources. If suspicious activity is detected, isolate the affected server to prevent lateral movement. Review application firewall rules to ensure they are configured to block common injection patterns. Check for any unauthorised changes to database records or user accounts.
What to do and how to stay safe: Arraytics
- Verify the current version of the Arraytics Booktics plugin on all managed servers.
- Implement strict input validation on all forms that interact with the booking system.
- Restrict database access rights to limit the potential impact of any successful injection.
- Await an official update from the vendor before applying any unofficial patches.
Step-by-step guide: Emergency Patching: How to Fix Critical Flaws Without Breaking Production
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the CVE ID for the Arraytics Booktics SQL injection flaw?
The vulnerability is tracked as CVE-2026-109894 by the National Vulnerability Database.
Which versions of Booktics are affected by this critical vulnerability?
All versions from the initial release through 1.0.29 are affected by this issue.
How severe is the SQL injection vulnerability in Booktics rated?
The National Vulnerability Database rates the severity as critical with a CVSS score of 9.3.
