Timetics CVE-2026-116860

The description states only that the flaw stems from incorrectly configured access control security levels in Timetics versions through 1.0.65 and does not name the exact feature, endpoint, or setting required, so the precise trigger is not described in the available sources. Based on the CVSS vector (AV:N/AC:L/PR:N/UI:N), no authentication, user interaction, or non-default configuration is indicated as a prerequisite - a remote actor can reach the vulnerable code against a standard install of the plugin. The principal limiting factor is impact scope rather than access: only integrity is affected at a low level (C:N/I:L/A:N), so an attacker can make unauthorized changes but cannot read protected data or disrupt availability. Exploitation is further bounded to sites actually running the Timetics plugin at or below version 1.0.65.

This is a moderate-severity Missing Authorization flaw (CWE-862) in the Timetics WordPress plugin, rated CVSS 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - network-reachable, low-complexity, requiring no privileges or user interaction, but limited to a low integrity impact only (no confidentiality or availability effect). Patchstack's priority label is 'this_month', not an emergency, which aligns with the limited impact. There is no CISA KEV listing and no EPSS score supplied, so there is no signal of active or likely imminent exploitation; the only reference is a Patchstack database entry, not verified working exploit code. The signals are internally consistent: the CVSS points to an easily reachable but low-consequence broken-access-control issue (an unauthenticated actor can likely invoke an action or modify some state they should not), and the absence of KEV/high EPSS indicates this is a routine plugin access-control bug rather than a widely weaponized target. The main caveat is that the description does not name the specific endpoint or action affected, so the precise scope of the integrity impact cannot be confirmed from the available data.

An unauthenticated remote attacker sends a crafted HTTP request to a Timetics plugin endpoint (e.g. an AJAX or REST action) that fails to verify the caller's authorization, allowing them to perform or alter an action reserved for privileged users. Because no authentication or user interaction is required (PR:N/UI:N) and complexity is low, the request can be issued directly against a vulnerable site; the impact is limited to unauthorized modification of data (I:L). No verified public exploit code is identified at time of analysis.