Vulnerabilities / Timetics – Appointment Booking Calendar & Scheduling / WPSEC-2026-3157
Timetics – Appointment Booking Calendar & Scheduling <= 1.0.66 - Unauthenticated Payment Bypass via 'payment_method' Parameter
Medium 5.3
CWE-863Fixed in 1.0.67
- ID
- WPSEC-2026-3157
- Plugin
- Timetics – Appointment Booking Calendar & Scheduling (timetics)
- Affected
- all versions before 1.0.67
- Remediation
- Update to 1.0.67 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-15
- Attack surface
- Timetics – Appointment Booking Calendar & Scheduling on WPSec AttackSurface
- Fix released
- Published
Description
The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to a payment bypass in all versions up to, and including, 1.0.66, due to insufficient validation of the 'payment_method' parameter when creating paid appointment bookings. Any payment method other than 'stripe' or 'woocommerce', including methods the site has not enabled, makes the booking take the site's default status, which is 'approved' by default. This makes it possible for unauthenticated attackers to book paid appointments and have them approved without paying.
References
- https://wpsec.com/vuln/WPSEC-2026-3157/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.67/
- https://wordpress.org/plugins/timetics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS