Timetics WordPress Plugin CVE-2026-14322

No authentication is required (PR:N confirmed by CVSS vector AV:N/AC:L/PR:N/UI:N). The sole prerequisite is that the target WordPress site has the Timetics plugin installed at a version below 1.0.57 with at least one priced appointment type configured. The bypass is triggered specifically when a booking is submitted using a payment method not in Timetics' recognized gateway list - if a site only offers recognized gateways and enforces selection, the attack surface may be narrowed, but this is a configuration-dependent mitigating factor rather than a reliable control. No special network position, account, or platform is required. Exploitation is limited to the booking integrity impact only; no confidentiality or availability impact is achievable through this vector.

The CVSS 3.1 score of 5.3 (Medium, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) accurately captures the limited blast radius: no data is exposed and no service is disrupted, but unauthorized write operations (approved bookings without payment) corrupt business logic. EPSS at 0.14% (4th percentile) indicates very low exploitation probability in the broader threat landscape, which partially contradicts the SSVC finding that the flaw is 'automatable' - this discrepancy suggests that while automated exploitation is technically feasible, the narrow deployment footprint of Timetics keeps real-world risk contained. A public POC exists (via WPScan), elevating urgency above the EPSS signal alone. KEV status is not confirmed, so this is not known to be actively exploited at scale. The primary real-world risk is financial: attackers can book paid appointment slots at no cost, causing revenue loss and calendar disruption for businesses running this plugin. SSVC Technical Impact is rated 'partial', consistent with integrity-only impact.

An attacker identifies a WordPress site using Timetics with priced appointment bookings by scanning for plugin-specific endpoints or checking publicly visible booking pages. They submit a booking request for a paid appointment slot, selecting or specifying a payment method not in the plugin's recognized gateway list, which causes the server to skip payment validation and mark the booking as fully approved. The attacker repeats this process automatically - the SSVC confirms automatable - to fill the merchant's calendar with free bookings, blocking legitimate paying customers and causing direct revenue loss.