Unauthenticated PHP Object Injection in Booktics <= 1.0.21 versions.

A critical unauthenticated PHP Object Injection vulnerability has been identified in the Booktics WordPress plugin affecting versions 1.0.21 and below. The vulnerability allows unauthenticated attackers to inject PHP objects, potentially leading to remote code execution, data manipulation, or other malicious outcomes depending on available POP chains in the environment. No authentication is required to exploit this vulnerability, making it particularly dangerous. The issue has been documented in the NVD and Patchstack vulnerability databases. Users of the Booktics plugin are strongly advised to update to a patched version immediately.