Vulnerabilities and security researches fortimetics timetics

Direction: ascending

Jun 17, 2024

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2024-1094

CVE, Research URL: CVE-2024-1094
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Jun 14, 2024
Research Description: The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.
Affected versions: max 1.0.22.
Status: vulnerable

Jul 02, 2024

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2024-37427

CVE, Research URL: CVE-2024-37427
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.21.
Affected versions: max 1.0.22.
Status: vulnerable

Aug 29, 2024

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2024-43923

CVE, Research URL: CVE-2024-43923
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in Arraytics Timetics allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Timetics: from n/a through 1.0.23.
Affected versions: max 1.0.24.
Status: vulnerable

Oct 18, 2024

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2024-9263

CVE, Research URL: CVE-2024-9263
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Oct 17, 2024
Research Description: The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
Affected versions: max 1.0.26.
Status: vulnerable

Dec 15, 2024

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2024-11275

CVE, Research URL: CVE-2024-11275
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Dec 13, 2024
Research Description: The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.
Affected versions: max 1.0.28.
Status: vulnerable

Apr 02, 2025

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2025-30828

CVE, Research URL: CVE-2025-30828
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Mar 27, 2025
Research Description: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.29.
Affected versions: max 1.0.30.
Status: vulnerable

Jan 10, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2025-64268

CVE, Research URL: CVE-2025-64268
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Dec 18, 2025
Research Description: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through <= 1.0.44.
Affected versions: max 1.0.45.
Status: vulnerable

Mar 30, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2025-15473

CVE, Research URL: CVE-2025-15473
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Mar 12, 2026
Research Description: The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
Affected versions: max 1.0.52.
Status: vulnerable

Apr 18, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2025-5919

CVE, Research URL: CVE-2025-5919
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Jan 06, 2026
Research Description: The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.
Affected versions: max 1.0.37.
Status: vulnerable

Apr 27, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-39432

CVE, Research URL: CVE-2026-39432
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: May 12, 2026
Research Description: Missing Authorization vulnerability in Arraytics Timetics allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Timetics: from n/a through 1.0.53.
Affected versions: max 1.0.54.
Status: vulnerable

Jun 13, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2025-67915

CVE, Research URL: CVE-2025-67915
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Jan 08, 2026
Research Description: Authentication Bypass Using an Alternate Path or Channel vulnerability in Arraytics Timetics timetics allows Authentication Abuse.This issue affects Timetics: from n/a through <= 1.0.46.
Affected versions: max 1.0.48.
Status: vulnerable

Jul 04, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-57674

CVE, Research URL: CVE-2026-57674
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Jul 02, 2026
Research Description: Unauthenticated Cross Site Scripting (XSS) in Timetics <= 1.0.58 versions.
Affected versions: max 1.0.59.
Status: vulnerable

Jul 31, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-14322

CVE, Research URL: CVE-2026-14322
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Jul 22, 2026
Research Description: The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.
Affected versions: max 1.0.57.
Status: vulnerable

Sep 04, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-84215

CVE, Research URL: CVE-2026-84215
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Sep 03, 2026
Research Description: Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.
Affected versions: max 1.0.62.
Status: vulnerable

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-14326

CVE, Research URL: CVE-2026-14326
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Sep 02, 2026
Research Description: The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
Affected versions: max 1.0.62.
Status: vulnerable

Oct 07, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-97304

CVE, Research URL: CVE-2026-97304
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Oct 06, 2026
Research Description: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
Affected versions: max 1.0.64.
Status: vulnerable

Nov 01, 2026

Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling # CVE-2026-116860

CVE, Research URL: CVE-2026-116860
Home page URL: Security reports for Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Application: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling
Date: Oct 30, 2026
Research Description: Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.
Affected versions: max 1.0.66.
Status: vulnerable