Timetics
Monthly
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.
Broken access control in the Timetics WordPress booking and scheduling plugin (versions ≤ 1.0.61) exposes unauthenticated REST or AJAX endpoints that lack authorization checks, allowing remote attackers to modify or disrupt scheduling data without any credentials. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms straightforward network exploitation requiring no authentication or user interaction against any WordPress site running the affected plugin. No public exploit code and no CISA KEV listing have been identified at time of analysis; real-world impact is bounded by the plugin's relatively limited deployment footprint.
Broken object-level authorization in the Timetics WordPress plugin through version 1.0.61 allows authenticated users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members via the REST API. The endpoint accepts appointment identifiers without validating ownership, enabling lateral privilege abuse among staff peers. A public WPScan PoC confirms exploitability, though real-world impact is bounded by the PR:H prerequisite of a pre-existing staff account.
Payment enforcement bypass in the Timetics WordPress booking plugin (versions before 1.0.57) allows unauthenticated remote users to generate fully-approved appointments for priced services without completing any payment. The plugin fails to validate booking status when the chosen payment method falls outside its recognized gateway list, effectively treating unverified payment submissions as completed transactions. A public proof-of-concept is available (reported by WPScan), and SSVC assessment confirms the flaw is automatable with partial technical impact, though EPSS remains low at 0.14%, suggesting exploitation is opportunistic rather than widespread.
Cross-Site Scripting in the Timetics WordPress appointment-booking plugin (by Arraytics) affects all versions up to and including 1.0.58, allowing unauthenticated remote attackers to inject script that executes in a victim's browser after the victim interacts with a crafted link or page. Because the CVSS scope is changed (S:C), a successful injection can affect resources beyond the vulnerable component, such as the browser session of a logged-in administrator. There is no public exploit identified at time of analysis, the CVE is not listed in CISA KEV, and no EPSS score was provided.
Missing authorization in Timetics WordPress plugin through version 1.0.53 allows unauthenticated remote attackers to bypass access controls and access sensitive administrative functions or data. With CVSS 8.2 (High), the vulnerability enables high confidentiality impact and low integrity impact against network-accessible instances. Patchstack reported this broken access control flaw, indicating potential exposure of booking systems, customer data, or administrative operations to unauthorized access without authentication.