Timetics – Appointment Booking Calendar & Scheduling <= 1.0.64 - Unauthenticated Booking Disclosure, Cancellation and Rescheduling via Weak 'appointment_token'
- ID
- WPSEC-2026-1471
- Plugin
- Timetics – Appointment Booking Calendar & Scheduling (timetics)
- Affected
- all versions before 1.0.65
- Remediation
- Update to 1.0.65 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-331
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Timetics – Appointment Booking Calendar & Scheduling on WPSec AttackSurface
- Fix released
- Published
Description
The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to authorization bypass via the 'appointment_token' parameter of the /timetics/v1/bookings/{id} REST API endpoint in all versions up to, and including, 1.0.64, due to insufficient entropy in the per-booking security token generated by the generate_security_token() function. The token holds only 32 bits of randomness, is the only check for guest requests, and is used with sequential booking IDs and no rate limiting. This makes it possible for unauthenticated attackers to brute-force the token for a booking and then view its details, including the customer's name, email and phone number, or cancel or reschedule it. The attack needs a very large number of requests.
References
- https://wpsec.com/vuln/WPSEC-2026-1471/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.65/
- https://wordpress.org/plugins/timetics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS