Timetics – Appointment Booking Calendar & Scheduling <= 1.0.66 - Missing Authorization to Existing User Account Modification via Guest Booking
- ID
- WPSEC-2026-3158
- Plugin
- Timetics – Appointment Booking Calendar & Scheduling (timetics)
- Affected
- from 1.0.2 before 1.0.67
- Remediation
- Update to 1.0.67 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-15
- Attack surface
- Timetics – Appointment Booking Calendar & Scheduling on WPSec AttackSurface
- Fix released
- Published
Description
The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to unauthorized modification of data via the public booking endpoint (/timetics/v1/bookings) in all versions up to, and including, 1.0.66, due to a missing ownership or capability check in Customer::make() when the submitted email belongs to an existing user. This makes it possible for unauthenticated attackers to add the timetics-customer role to any existing account, including administrators, and to overwrite the stored first name, last name and phone number of existing Timetics customers by submitting a booking with that user's email address.
References
- https://wpsec.com/vuln/WPSEC-2026-3158/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.67/
- https://wordpress.org/plugins/timetics/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS