# Timetics – Appointment Booking Calendar & Scheduling <= 1.0.64 - Unauthenticated Booking Disclosure, Cancellation and Rescheduling via Weak 'appointment_token'

- **ID:** WPSEC-2026-1471
- **Plugin:** Timetics – Appointment Booking Calendar & Scheduling (`timetics`), https://wordpress.org/plugins/timetics/
- **Affected versions:** all versions before 1.0.65
- **Fixed in:** 1.0.65 (Update to 1.0.65 or later.)
- **Severity:** Medium 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-331
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/timetics
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1471/

## Description

The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to authorization bypass via the 'appointment_token' parameter of the /timetics/v1/bookings/{id} REST API endpoint in all versions up to, and including, 1.0.64, due to insufficient entropy in the per-booking security token generated by the generate_security_token() function. The token holds only 32 bits of randomness, is the only check for guest requests, and is used with sequential booking IDs and no rate limiting. This makes it possible for unauthenticated attackers to brute-force the token for a booking and then view its details, including the customer's name, email and phone number, or cancel or reschedule it. The attack needs a very large number of requests.

## References

- https://wpsec.com/vuln/WPSEC-2026-1471/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.65/
- https://wordpress.org/plugins/timetics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1471/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.