Description

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-07-22T07:16:35.307Z",
  "pubdate": "2026-07-22T07:16:35.307Z",
  "executiveSummary": "The Timetics WordPress plugin prior to version 1.0.57 suffers from an access control and business logic vulnerability affecting booking state enforcement.\nSpecifically, the application fails to enforce a pending or unpaid status for new bookings created via alternative, unrecognized payment methods.\nThis architectural flaw allows unauthenticated threat actors to interact with the appointment booking functionality and generate fully-approved booking records for priced appointments without executing any financial transaction.\nThe impact of this vulnerability includes severe financial loss, resource exhaustion, and unauthorized service consumption, as attackers can bypass payment gateways entirely.\nThe risk is elevated due to the lack of required authentication or privilege levels, meaning any external user with network access to the target WordPress installation can abuse the booking endpoint.\nSuccessful exploitation requires no prior interaction or credentials, lowering the barrier to entry for malicious actors seeking to abuse monetized scheduling features.",
  "technicalDetails": "The root cause of the vulnerability lies in improper state validation and insufficient input sanitization within the booking creation workflow of the Timetics WordPress plugin.\nWhen a user initiates a booking for a priced appointment utilizing a payment method outside of the plugin's explicitly recognized and validated gateways, the backend logic fails to assign a constrained status such as pending or unpaid.\nInstead, the state machine defaults to or accepts a fully-approved status without verifying payment confirmation tokens or validating transaction receipts from a trusted payment processor.\nThe vulnerable component resides within the booking processing handler responsible for parsing transaction vectors and instantiating appointment records in the database.\nAffected versions include all iterations of the Timetics WordPress plugin prior to 1.0.57.\nThe attack flow proceeds as follows: First, an unauthenticated attacker identifies a priced appointment slot exposed by the plugin via the web interface. Second, the attacker formulates an HTTP request to the booking endpoint, specifying an unrecognized or arbitrary payment method parameter designed to bypass the standard gateway verification routines. Third, the backend application processes the booking submission, instantiating the appointment entry in the database. Due to the absence of strict status enforcement, the application marks the booking as fully approved. Finally, the attacker receives confirmation of a valid appointment without rendering payment, securing unauthorized access to the scheduled service.\nNetwork exposure is fully external, accessible via standard HTTP/HTTPS protocols exposed by the WordPress site. No authentication or low-level privileges are required to trigger the vulnerable code path, allowing automated exploitation scripts to mass-create fraudulent appointments."
}