WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 — Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion
CVE-2024-11275Published · Updated Action summary
Affected: ≤1.0.27Update to 1.0.28 or newer
All remediation steps- Severity
- Medium4.3
- CVSS
- 4.3CVSS 3.1 · CNA (Wordfence)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NWhat does this vector mean?
AV:NAttack vector- Network
AC:LAttack complexity- Low
PR:LPrivileges required- Low
UI:NUser interaction- None
S:UScope- Unchanged
C:NConfidentiality- None
I:LIntegrity- Low
A:NAvailability- None
- Required access
- Unknown
- Exploit prediction (EPSS)
- No score
- CISA KEV
- Not listed
On this page8
Am I affected?
Timetics – Appointment Booking Calendar & Scheduling timetics
- Affected≤ 1.0.27
- Patched in1.0.28
Update to 1.0.28 or newer.
You are affected if you run ≤ 1.0.27. Version 1.0.28 and later are not affected by this issue.
- Check your version: in wp-admin go to Plugins → Installed Plugins and read the version under Timetics – Appointment Booking Calendar & Scheduling.
- No admin access? Run a passive check of your site. It reads public files only.
What to do
- Update to version 1.0.28, or a newer patched version
- Rotate administrator passwords and application secrets if the site ran a vulnerable version while publicly reachable.
- Watch Timetics – Appointment Booking Calendar & Scheduling to get an email when the next vulnerability is published.
Advisory
Source description from Wordfence Intelligence, credited to Thanh Nam Tran.
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Exploits & references
Proof-of-concept & detection
No public proof-of-concept or detection template is known for this vulnerability.
Advisories & patches
- Advisorywordfence.com
Related CVEs
More in Timetics – Appointment Booking Calendar & Scheduling
All 16| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium5.3 | Missing Authorization ≤1.0.65Update to 1.0.66 | CVE-2026-116860 | |
| Medium5.3 | Missing Authorization ≤1.0.63Update to 1.0.64 | CVE-2026-97304 | |
| Medium5.3 | Missing Authorization ≤1.0.61Update to 1.0.62 | CVE-2026-84215 | |
| Medium4.3 | Authenticated (Staff+) Insecure Direct Object Reference <1.0.62Update to 1.0.62 | CVE-2026-14326 | |
| Medium5.3 | Missing Authorization to Unauthenticated Booking Approval ≤1.0.56Update to 1.0.57 | CVE-2026-14322 |
- Medium5.3Missing Authorization
≤1.0.65Update to 1.0.66
- Medium5.3Missing Authorization
≤1.0.63Update to 1.0.64
- Medium5.3Missing Authorization
≤1.0.61Update to 1.0.62
- Medium4.3Authenticated (Staff+) Insecure Direct Object Reference
<1.0.62Update to 1.0.62
- Medium5.3Missing Authorization to Unauthenticated Booking Approval
≤1.0.56Update to 1.0.57
Timeline
CVE published
Severity medium, CVSS 4.3
Record last updated
Sources & licenses
Wordfence record- Vulnerability data
- Wordfence Intelligence. Copyright 2012-2026 Defiant Inc. Licensed under the CC BY-SA 4.0.
- CVE® identifiers
- Copyright 1999-2026 The MITRE Corporation. Used under the CVE Program. CVE® is a registered trademark of The MITRE Corporation.
- CVSS / CWE
- National Vulnerability Database (NVD), shown unmodified. This product uses the NVD API but is not endorsed or certified by the NVD.
- VulnCrest content
- Summary, remediation guidance and page layout © VulnCrest. Not sourced from NVD.