EUVD-2026-70034
GHSA-xhxv-x276-mmhp
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
Staff role required (PR:H); REST API reachable over network (AV:N); no confidentiality impact, low integrity and availability from peer-appointment manipulation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
AnalysisAI
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a WordPress account assigned the Timetics plugin's custom 'staff' role on the target site, running Timetics version 1.0.61 or earlier with the plugin active. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 3.8 (Low) with vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L is a reasonable reflection of the limited blast radius: no confidentiality exposure, only low-severity integrity and availability effects, and a hard prerequisite of holding the plugin's staff-role account. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version is identified in the available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remo
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to byp
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticate
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today