{
 "id": "WPSEC-2026-3157",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3157/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3157/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3157/index.md",
 "title": "Timetics – Appointment Booking Calendar & Scheduling <= 1.0.66 - Unauthenticated Payment Bypass via 'payment_method' Parameter",
 "description": "The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to a payment bypass in all versions up to, and including, 1.0.66, due to insufficient validation of the 'payment_method' parameter when creating paid appointment bookings. Any payment method other than 'stripe' or 'woocommerce', including methods the site has not enabled, makes the booking take the site's default status, which is 'approved' by default. This makes it possible for unauthenticated attackers to book paid appointments and have them approved without paying.",
 "plugin": {
  "slug": "timetics",
  "name": "Timetics – Appointment Booking Calendar & Scheduling",
  "full_name": "Timetics – Appointment Booking Calendar & Scheduling",
  "wordpress_org": "https://wordpress.org/plugins/timetics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/timetics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/timetics"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-863"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.0.67",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.0.67"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.0.67",
 "remediation": "Update to 1.0.67 or later.",
 "fix_released": "2026-11-14T06:14:49+00:00",
 "published": "2026-11-15T06:40:49+00:00",
 "updated": "2026-11-14T16:17:17.006714+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3157/",
  "https://plugins.svn.wordpress.org/timetics/tags/1.0.67/",
  "https://wordpress.org/plugins/timetics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/timetics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-15"
 }
}