# Timetics – Appointment Booking Calendar & Scheduling <= 1.0.66 - Missing Authorization to Existing User Account Modification via Guest Booking

- **ID:** WPSEC-2026-3158
- **Plugin:** Timetics – Appointment Booking Calendar & Scheduling (`timetics`), https://wordpress.org/plugins/timetics/
- **Affected versions:** from 1.0.2 before 1.0.67
- **Fixed in:** 1.0.67 (Update to 1.0.67 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/timetics
- **Fix released:** 2026-11-14
- **Published:** 2026-11-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3158/

## Description

The Timetics – Appointment Booking Calendar & Scheduling plugin for WordPress is vulnerable to unauthorized modification of data via the public booking endpoint (/timetics/v1/bookings) in all versions up to, and including, 1.0.66, due to a missing ownership or capability check in Customer::make() when the submitted email belongs to an existing user. This makes it possible for unauthenticated attackers to add the timetics-customer role to any existing account, including administrators, and to overwrite the stored first name, last name and phone number of existing Timetics customers by submitting a booking with that user's email address.

## References

- https://wpsec.com/vuln/WPSEC-2026-3158/
- https://plugins.svn.wordpress.org/timetics/tags/1.0.67/
- https://wordpress.org/plugins/timetics/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3158/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.