WordPress Plugin Vulnerabilities

Time Slots Booking Form < 1.2.40 - Missing Authorization

Description

The WP Time Slots Booking Form plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.2.39. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
wp-time-slots-booking-form
Fixed in 1.2.40

References

CVE
CVE-2025-68569
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/9bc3c8c4-9f56-467b-a772-743f007d6bef

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
a9c1e754-7a7c-4d48-864d-b3c4ec536c9f

Timeline

Publicly Published
2025-12-20 (about 9 months ago)
Added
2026-01-06 (about 8 months ago)
Last Updated
2026-01-06 (about 8 months ago)

Other

Published
Title
Published
2024-12-20
Title
WP BASE Booking of Appointments, Services and Events < 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via app_export_db
Published
2026-03-07
Title
Elementor Website Builder < 3.35.6 - Missing Authorization
Published
2026-01-25
Title
TOP Table Of Contents < 1.4.0 - Missing Authorization
Published
2024-08-07
Title
Hummingbird < 3.9.2 - Missing Authorization
Published
2025-04-15
Title
JetPopup < 2.0.12 - Missing Authorization