Timetics CVE-2026-97304

Exploitable against any WordPress site with the Timetics plugin installed and activated at version 1.0.63 or earlier. The flaw stems from incorrectly configured access control security levels (missing authorization on one or more plugin actions/endpoints), so no special non-default configuration is required beyond having the vulnerable plugin active. Per the CVSS vector (PR:N/UI:N), exploitation is unauthenticated and needs no victim interaction. Limiting factors: impact is bounded to limited integrity and availability (C:N/I:L/A:L), so an attacker cannot read confidential data or achieve full compromise through this flaw alone; exposure also depends on the specific plugin endpoint being reachable on the target.

This is a moderate-severity (CVSS 6.5) broken access control / missing authorization flaw (CWE-862) in the Arraytics Timetics WordPress plugin, reported by Patchstack. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which normally elevates priority. However, the impact is deliberately constrained: C:N, I:L, A:L - no confidentiality loss and only limited integrity and availability impact, consistent with an authorization gap that lets an unauthenticated actor reach functionality or modify/affect data they should not, rather than a full takeover. Critically, there is no CISA KEV listing, no EPSS score provided, no SSVC decision data, and no public POC referenced - so despite the 'easy' exploitability profile there is currently no evidence of real-world exploitation. Net assessment: a genuine but second-tier patch priority. The low-barrier unauthenticated vector means it should be patched promptly, but the limited impact and absence of exploitation signals place it below critical-severity or actively-exploited issues. Note the data gap: EPSS, KEV, and POC status are all absent from the input, so exploitation likelihood cannot be quantified beyond the CVSS exploitability metrics.

An unauthenticated attacker sends a crafted HTTP request directly to a Timetics plugin endpoint (e.g., a REST/AJAX action) that fails to enforce a capability or authorization check. Because no authentication, privileges, or user interaction are required (AV:N/AC:L/PR:N/UI:N), the attacker reaches restricted functionality to read-protected actions or modify booking/configuration data, causing limited integrity and availability impact. No public exploit code was identified at time of analysis.