# Timetics – Appointment Booking Calendar & Scheduling <= 1.0.66 - Unauthenticated Payment Bypass via 'payment_method' Parameter

- **ID:** WPSEC-2026-3157
- **Plugin:** Timetics – Appointment Booking Calendar & Scheduling (`timetics`), https://wordpress.org/plugins/timetics/
- **Affected versions:** all versions before 1.0.67
- **Fixed in:** 1.0.67 (Update to 1.0.67 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-863
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/timetics
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3157/

## Description

The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to a payment bypass in all versions up to, and including, 1.0.66, due to insufficient validation of the 'payment_method' parameter when creating paid appointment bookings. Any payment method other than 'stripe' or 'woocommerce', including methods the site has not enabled, makes the booking take the site's default status, which is 'approved' by default. This makes it possible for unauthenticated attackers to book paid appointments and have them approved without paying.

## References

- https://wpsec.com/vuln/WPSEC-2026-3157/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.67/
- https://wordpress.org/plugins/timetics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3157/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.