Unknown Timetics vulnerabilities

3 vulnerabilities

Known vulnerabilities in Unknown Timetics, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.3CVE-2025-15473unknowntimetics+1
EPSS score
0.17%
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.4.3CVE-2026-14326unknowntimetics+1
EPSS score
0.22%
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.5.3CVE-2026-14322unknowntimetics+1
EPSS score
0.30%
The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.