Arraytics

By the Year

In 2026 there have been 36 vulnerabilities in Arraytics with an average score of 6.7 out of ten. Last year, in 2025 Arraytics had 8 security vulnerabilities published. That is, 28 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 1.04

Recent Arraytics Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-97300	Oct 06, 2026	CVE-2026-97300: Unauth BA Control in WP Event Sol <=4.1.25 Unauthenticated Broken Access Control in WP Event Solution <= 4.1.25 versions.	Wp Event Solution
CVE-2026-97304	Oct 05, 2026	Missing Authorization in Arraytics Timetics (1.0.63) Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.	Timetics
CVE-2026-11601	Oct 03, 2026	WPCafe WP Menu Plugin 3.0.19 or Earlier Auth Bypass (E-Mail Flow) The WPCafe Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.19. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to read, create, update, clone, and delete email notification flows, including overwriting the default reservation confirmation, cancellation, and admin alert emails with attacker-controlled content sent from the site's legitimate address, or destroying reservation notification flows entirely. The vulnerable endpoints are active by default on every WPCafe installation without any configuration requirement, as the Email_Automation_Service_Provider::is_enable() method unconditionally returns true and the plugin ships with five pre-configured default email flows upon activation.	Wp Cafe
CVE-2026-75028	Oct 03, 2026	WPCafe Plugin LFI <=3.0.18 via template scope The WPCafe Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.0.18 via the (template scope) function. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.	Wp Cafe
CVE-2026-75983	Sep 15, 2026	Eventin WP Plugin <4.1.23 Privilege Escalation via map_meta_cap The Eventin Event Calendar, Tickets, Registration, Booking & WooCommerce plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 4.1.23. This is due to the `PermissionManager::manage_permissions()` function being registered as a callback on WordPress core's `map_meta_cap` filter and unconditionally returning the always-true `'exist'` primitive for every capability check whenever the evaluated user ID is 1, without scoping this behavior to plugin-specific capabilities. This makes it possible for authenticated attackers whose account is user ID 1, even subscribers, to pass every WordPress capability check, including `manage_options`, `edit_plugins`, `edit_themes`, `promote_users`, and `update_core`, thereby elevating their privileges to administrator-equivalent power and achieving full site takeover, including remote code execution via the plugin and theme editors. Exploitation is only impactful when user ID 1 has been deliberately demoted to a lower-privilege role as a common administrator-account hardening practice; on default installations where user ID 1 retains the administrator role, no incremental privilege gain occurs.
CVE-2026-15402	Sep 15, 2026	Eventin WP Plugin v4.1.23 Stored XSS via etn_shedule_objective The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-62135	Sep 11, 2026	Unauth BnA in Booktics <=1.0.24 Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions.	Booktics
CVE-2026-11446	Sep 11, 2026	Booktics Booking Calendar <=1.0.23 Unauth Data Tampering via orders API The Booktics Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and including, 1.0.23. This is due to the create_order_permission() permission callback on the POST /wp-json/booktics/v1/orders REST route unconditionally returning true, combined with find_and_update_guest() overwriting an existing customer record's stored name, phone, and wp_user_id whenever the caller-supplied email matches, with no proof of ownership. This makes it possible for unauthenticated attackers to overwrite the contact details (name and phone) of any existing customer whose email address they know, poisoning downstream reminder emails, SMS, calendar invites, and CRM data.	Booktics
CVE-2026-15398	Sep 09, 2026	Eventin WP Plugin 4.1.22 Auth Bypass via Public wp_rest Nonce
CVE-2026-11821	Sep 09, 2026	Eventin WordPress Plugin <=4.1.17 Auth Bypass (Non-Admin) The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.1.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to view, create, update, clone, and delete notification flow event automation workflows that should be restricted to administrators.
CVE-2026-15667	Sep 09, 2026	WordPress Eventin LFI via event_layout (4.1.22) The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. The etn_manage_event capability is assigned to Contributors by default, meaning any Contributor-level user can set the malicious event_layout value via the REST API without any additional configuration.
CVE-2026-15406	Sep 09, 2026	Eventin WP Plugin 4.1.22 LFI via event_layout The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.1.22 via the 'event_layout' parameter parameter. This makes it possible for authenticated attackers, with custom-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVE-2026-12956	Sep 09, 2026	Missing Auth in Eventin <=4.1.22 Enables Unauth Order Creation The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() handler for the /wp-json/eventin/v2/orders REST endpoint. The endpoint's create_item_permissions_check() function only verifies a wp_rest nonce (which is leaked to every visitor through the etn-public script's localized_data_obj on every frontend page) and accepts a user-supplied 'status' value in prepare_item_for_database() with no whitelist validation. This makes it possible for unauthenticated attackers to create etn-order posts with status='completed' that are counted as sold by etn_get_sold_tickets_by_event(); because the auto-cleanup wp_schedule_single_event() in create_item() only fires for status='pending' orders, the forged completed orders persist indefinitely and exhaust ticket inventory.
CVE-2026-84215	Sep 03, 2026	Timetics <=1.0.61 Unauth BADC (CVE-2026-84215) Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.	Timetics
CVE-2026-82223	Sep 02, 2026	Unauthenticated Bc in WP Event Solution <= 4.1.22 Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions.	Wp Event Solution
CVE-2026-28002	Aug 13, 2026	Booktics <=1.0.22 Blind SQLi via Special Elements Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection. This issue affects Booktics: from n/a through 1.0.22.	Booktics
CVE-2026-28174	Aug 13, 2026	WP Event Solution <=4.1.18: Sensitive Data Exposure Customer Sensitive Data Exposure in WP Event SOlution <= 4.1.18 versions.	Wp Event Solution
CVE-2026-28173	Aug 13, 2026	WP Event SOlution <=4.1.19 Arbitrary Content Deletion CVE-2026-28173 Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.	Wp Event Solution
CVE-2026-66451	Aug 06, 2026	WP Event Solution <=4.1.9 Unauthenticated Auth Bypass Unauthenticated Broken Authentication in WP Event SOlution <= 4.1.9 versions.	Wp Event Solution
CVE-2026-13039	Jul 10, 2026	Eventin WP Plugin v4.0.26-4.1.15 Auth Bypass in payment_complete The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression in versions from 4.0.26 up to and including 4.1.15. This is due to the plugin not properly verifying that a user is authorized to perform an action in the payment_complete() function of PaymentController.php. This makes it possible for unauthenticated attackers to mark unpaid ticket orders as completed by submitting a fabricated SureCart checkout ID or FluentCart cart hash, granting themselves paid event access, QR-code attendee tickets, and order confirmation emails without making any real payment. The wp_rest nonce required to reach the vulnerable endpoint is embedded in every public event page, meaning no WordPress session or credentials are needed to obtain it. This vulnerability represents a regression the same function and endpoint were previously patched but the fix did not persist through subsequent releases.
CVE-2026-12924	Jul 10, 2026	Eventin WP Plugin 4.1.15 Stored XSS via etn_faq_content The Eventin Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'etn_faq_content' parameter in all versions up to, and including, 4.1.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-11818	Jul 10, 2026	WPCafe 3.0.14 Auth Bypass on Notification Workflows via WP REST Nonce The WPCafe Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with subscriber-level access and above, to list, create, update, delete, clone, and bulk-delete notification flow workflows that are intended to be managed only by administrators. The only protection on these endpoints is a wp_rest nonce check, which is obtainable by any logged-in user from the frontend page source.	Wp Cafe
CVE-2026-57674	Jul 02, 2026	XSS in Timetics <=1.0.58 Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.	Timetics
CVE-2026-57621	Jul 02, 2026	Unauth PHP Object Injection in Booktics <= 1.0.21 Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.
CVE-2026-57622	Jun 26, 2026	WPCafe Plugin 3.0.14 Subscriber Broken Access Control (CVE-2026-57622) Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.	Wp Cafe
CVE-2025-68045	Jun 16, 2026	Unauth CA: WP Event Solution <=4.1.12 Vulnerable Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions.	Wp Event Solution
CVE-2026-40776	Jun 15, 2026	Unauthenticated Access Control Flaw WP Event Solution <=4.1.8 Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.	Wp Event Solution
CVE-2026-39432	May 12, 2026	Arraytics Timetics Missing Authorization pre-1.0.53 Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.53.	Timetics
CVE-2026-4109	Apr 14, 2026	Unauthorized Data Access in Eventin Events Calendar 4.1.8 The Eventin Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a improper capability check on the get_item_permissions_check() function in all versions up to, and including, 4.1.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read arbitrary order data including customer PII (name, email, phone) by iterating order IDs.
CVE-2026-39585	Apr 08, 2026	Arraytics Booktics <1.0.16: Missing Auth Incorr. Access Ctrl Missing Authorization vulnerability in Arraytics Booktics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Booktics: from n/a through 1.0.16.	Booktics
CVE-2026-27071	Mar 25, 2026	Arraytics WPCafe missing auth in wpcafe <=3.0.7 Missing Authorization vulnerability in Arraytics WPCafe wp-cafe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCafe: from n/a through <= 3.0.7.	Wp Cafe
CVE-2026-1919	Mar 10, 2026	Booktics WP Plugin 1.0.16 - Unauth Data Access via Missing Capability Check The Booking Calendar for Appointments and Service Businesses Booktics plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to query sensitive data.
CVE-2026-1920	Mar 10, 2026	Unauthorized Plugin Install in Booktics (1.0.16) - Missing Capability Check The Booking Calendar for Appointments and Service Businesses Booktics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'Extension_Controller::update_item_permissions_check' function in all versions up to, and including, 1.0.16. This makes it possible for unauthenticated attackers to install addon plugins.
CVE-2025-68047	Jan 22, 2026	Eventin WP Plugin <=4.1.1: Deserialization of Untrusted Data OI Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.1.3.	Wp Event Solution
CVE-2025-14657	Jan 09, 2026	Eventin Plugin <=4.0.51 Data Tampering & XSS via Missing Capability Check The Eventin Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'post_settings' function in all versions up to, and including, 4.0.51. This makes it possible for unauthenticated attackers to modify plugin settings. Furthermore, due to insufficient input sanitization and output escaping on the 'etn_primary_color' setting, this enables unauthenticated attackers to inject arbitrary web scripts that will execute whenever a user accesses a page where Eventin styles are loaded.
CVE-2025-67915	Jan 08, 2026	Timetics Auth Bypass via Alternate Path <=1.0.46 Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.	Timetics
CVE-2025-64268	Dec 18, 2025	Missing Auth in Arraytics Timetics <=1.0.44 Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.	Timetics
CVE-2025-7813	Aug 23, 2025	The Events Calendar, Event Booking, Registrations and Event Tickets Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 The Events Calendar, Event Booking, Registrations and Event Tickets Eventin plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.37 via the proxy_image function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVE-2025-49869	Aug 14, 2025	Deser of Untrusted Data in Arraytics Eventin <4.0.31 Allows Obj Injection Deserialization of Untrusted Data vulnerability in Arraytics Eventin wp-event-solution allows Object Injection.This issue affects Eventin: from n/a through <= 4.0.31.	Wp Event Solution
CVE-2025-47445	May 14, 2025	WordPress Plugin Eventin <=4.0.26 Path Traversal (CVE-2025-47445) Relative Path Traversal vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.26.	Wp Event Solution
CVE-2025-3419	May 08, 2025	Eventin WP Plugin 4.0.26 Arbitrary File Read via proxy_image() (CVE-2025-3419) The Event Manager, Events Calendar, Tickets, Registrations Eventin plugin for WordPress is vulnerable to arbitrary file read in all versions up to, and including, 4.0.26 via the proxy_image() function. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. CVE-2025-47445 is a duplicate of this vulnerability.
CVE-2025-30828	Mar 27, 2025	Missing Auth in Arraytics Timetics v<1.0.29: Incorrect ACL Exploit Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.29.	Timetics
CVE-2025-30829	Mar 27, 2025	WPCafe <2.2.31: PHP LFI via Improper File Include Control Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.31.	Wp Cafe
CVE-2025-26964	Feb 25, 2025	PHP LFI in Themewinter Eventin <= 4.0.20 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics Eventin wp-event-solution allows PHP Local File Inclusion.This issue affects Eventin: from n/a through <= 4.0.20.	Wp Event Solution
CVE-2024-56213	Dec 31, 2024	Themewinter Eventin Path Traversal Vulnerability Path Traversal: '.../...//' vulnerability in Arraytics Eventin wp-event-solution allows Path Traversal.This issue affects Eventin: from n/a through <= 4.0.7.	Wp Event Solution
CVE-2024-11275	Dec 13, 2024	WP Timetics Plugin: Unauthorized User Deletion Vulnerability in REST API Endpoint The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
CVE-2023-49756	Dec 09, 2024	Eventin 3.3.52 WP Plugin Missing Auth - Improper Access Control Missing Authorization vulnerability in Arraytics Eventin wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eventin: from n/a through <= 3.3.52.	Wp Event Solution
CVE-2024-43923	Nov 01, 2024	Arraytics Timetics Missing Auth Vulnerability (1.0.23) Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.	Wp Timetics
CVE-2024-6033	Jul 17, 2024	Eventin WP Plugin <4.0.4 Unauthorized Data Import (Contributor+) The Event Manager, Events Calendar, Tickets, Registrations Eventin plugin for WordPress is vulnerable to unauthorized data importation due to a missing capability check on the 'import_file' function in all versions up to, and including, 4.0.4. This makes it possible for authenticated attackers, with Contributor-level access and above, to import events, speakers, schedules and attendee data.
CVE-2024-1094	Jun 14, 2024	Timetics WP Plugin v1.0.21 Missing Cap Check Enables Unauthorized Staff Grant The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.	Timetics