Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-14326

Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

CVSS 3.1 · 3.8 Low EPSS < 1% KEV · Not listed
Vendors
Timetics Wordpress
Products
Timetics Wordpress
CVE-2026-14322

Timetics < 1.0.57 - Unauthenticated Booking Auto-Approval via Arbitrary payment_method

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Timetics Wordpress
Products
Timetics Wordpress
CVE-2025-15473

Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Timetics Wordpress
Products
Timetics Wordpress