Skip to content
Sign in
4.3 Medium

CVE-2025-15473 The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated…

Description

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.

Affected products and versions

Product Affected versions Fixed in
Timetics 1.0 earliest → < 1.0.52 1.0.52

Other CVEs of Timetics

The 3 CVEs of Timetics →
CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through… 3.8 Low CVE-2026-14322 The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created… 5.3 Medium
Track this CVE