EUVD-2026-47614
GHSA-4m7v-hj47-rqcr
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible, no auth required, low integrity impact only; no confidentiality or availability impact from booking fraud.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.
AnalysisAI
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Technical ContextAI
Timetics is a WordPress appointment and booking plugin. The vulnerability stems from CWE-284 (Improper Access Control) in the booking creation workflow. Specifically, the plugin's server-side logic does not enforce a 'pending' or 'unpaid' status guard when a booking is submitted via a payment method not included in the plugin's recognized gateway list. Instead of defaulting to an unconfirmed state pending payment verification, the booking is transitioned directly to a fully-approved status. The affected CPE is cpe:2.3:a:unknown:timetics:*:*:*:*:*:*:*:* covering all versions prior to 1.0.57. The root cause is a missing state-machine check at the payment-method branching point in booking creation logic, a classic authorization bypass rather than a cryptographic or injection flaw.
RemediationAI
The primary fix is to update the Timetics plugin to version 1.0.57 or later, which enforces proper booking status validation regardless of the submitted payment method. The patch is confirmed available from the vendor per WPScan (https://wpscan.com/vulnerability/0fb14dca-d4aa-4c24-bf15-37099edb7614/) and referenced via VulnDB advisory https://vuldb.com/vuln/382259. If immediate upgrade is not possible, administrators should temporarily disable the booking form for priced appointments or restrict access to the booking endpoint to authenticated users only via a WAF or WordPress access control plugin. Alternatively, disabling the ability to select non-recognized payment gateways at checkout (if configurable) would eliminate the bypass path, though this may reduce functionality for legitimate users. Site owners should audit existing bookings created after the plugin was installed to identify fraudulently approved reservations and reverse them manually.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to byp
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users hol
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticate
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today