WordPress Plugin Vulnerabilities

Timetics – Appointment Booking & Scheduling < 1.0.54 - Missing Authorization

Description

The Timetics – Appointment Booking & Scheduling plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.0.53. This makes it possible for unauthenticated attackers to perform an unauthorized action.

Affects Plugins

Plugin icon
timetics
Fixed in 1.0.54

References

CVE
CVE-2026-39432
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/0e62968e-2b0f-4ee6-8ae9-f84d5ff39dba

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Simone Maion
Verified
No
WPVDB ID
04b40296-8dcd-49bc-b421-299292e22d3b

Timeline

Publicly Published
2026-04-07 (about 1 month ago)
Added
2026-04-15 (about 1 month ago)
Last Updated
2026-04-15 (about 1 month ago)

Other

Published
Title
Published
2025-06-18
Title
GiveWP – Donation Plugin and Fundraising Platform < 4.3.1 - Missing Authorization To Authenticated (Contributor+) Campaign Data View And Modification
Published
2025-12-10
Title
Knowband Mobile App Builder for wooCommerce < 3.0.0 – Unauthenticated Arbitrary User Deletion
Published
2026-03-10
Title
User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration < 4.2.6 - Missing Authorization
Published
2024-10-09
Title
CubeWP – All-in-One Dynamic Content Framework < 1.1.16 - Missing Authorization
Published
2025-08-06
Title
Coupon Affiliates < 6.4.2 - Missing Authorization to Unauthenticated Settings Update