Timetics CVE-2026-84215

No special conditions beyond network reachability - the CVSS vector PR:N/AC:L/UI:N confirms unauthenticated exploitation against default installations of Timetics ≤ 1.0.61 on any publicly accessible WordPress site. Limiting factors are: (1) the target WordPress site must have the Timetics plugin installed and activated; (2) impact is bounded to Timetics booking/scheduling data (C:N means no broader WordPress account or credential exposure through this vector); (3) the specific endpoint(s) affected are not named in the available description, which may slightly complicate exploitation without source-code review.

The CVSS 6.5 score with S:U/C:N/I:L/A:L reflects a genuine but bounded threat: no confidentiality exposure, and integrity and availability impact are both limited in scope to the plugin's data domain (booking records, schedules). The PR:N/AC:L posture means exploitation is trivially automatable, raising the possibility of mass-scanning for vulnerable WordPress installations. However, no EPSS data was provided, no KEV listing exists, and no public proof-of-concept code has been identified, keeping real-world exploitation risk moderate rather than severe. The absence of a confidentiality impact (C:N) means sensitive user PII stored elsewhere in WordPress is not directly at risk through this vector. The primary concern is sabotage of scheduling data - cancelling or corrupting appointments - rather than account compromise or data theft. SSVC assessment: exploitation status unproven, automatable yes (AV:N/AC:L/PR:N), technical impact partial.

An unauthenticated attacker scans for WordPress sites with the Timetics plugin active, then sends crafted HTTP POST requests directly to the plugin's unprotected endpoint - bypassing the absent authorization check - to delete, modify, or create appointment records. No proof-of-concept code is publicly known, but the low attack complexity means a motivated attacker could develop one quickly from the Patchstack disclosure alone.