Description

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.8",
  "pubDate": "2026-09-02T15:17:37.553Z",
  "pubdate": "2026-09-02T15:17:37.553Z",
  "executiveSummary": "The Timetics WordPress plugin, up to version 1.0.61, contains an Insecure Direct Object Reference (IDOR) vulnerability within its REST API implementation. This flaw stems from a lack of server-side ownership validation when processing appointment update requests. By failing to verify that the requesting user maintains proper authorization over a specific appointment object, the application permits authenticated users assigned the custom 'staff' role to manipulate appointment data belonging to other staff members or administrative entities. The impact of this vulnerability is significant, as it grants unauthorized users the capability to modify, disable, or effectively hijack appointments, leading to potential data integrity loss and unauthorized service scheduling. The flaw is exploitable over the network by any user authenticated with the staff role, requiring no further elevated privileges or specific infrastructure knowledge beyond access to the vulnerable REST API endpoints. This constitutes a critical breakdown in access control logic, necessitating immediate remediation to ensure administrative and operational boundaries are enforced within the WordPress environment.",
  "technicalDetails": "The root cause of this vulnerability is an Insecure Direct Object Reference (IDOR) located within the Timetics REST API. In the affected versions (1.0.61 and earlier), the API endpoints responsible for handling appointment updates perform an authorization check that only validates the user's role—specifically verifying that the requester possesses the custom 'staff' role—without performing a granular authorization check on the object being accessed.\nWhen a user triggers an update request through the API, the backend application accepts an appointment identifier (ID) as part of the request payload or URL parameter. The application proceeds to execute the update operation based on this ID without verifying that the appointment record is strictly owned by or assigned to the current user's session. Consequently, the application assumes that any user with the 'staff' role is authorized to perform state changes on any appointment object retrieved from the database.\nThe attack flow follows a predictable pattern: first, an attacker authenticated with the 'staff' role intercepts a legitimate REST API request used to modify their own appointments. By observing the API request structure, the attacker identifies the parameter corresponding to the appointment ID. The attacker then crafts a malicious request by substituting the target appointment ID—which belongs to another staff member or a different user—into the request parameters. Upon submission, the API processes the modification request and updates the target object's status, metadata, or scheduling information in the database. Because the application logic fails to compare the 'user_id' associated with the appointment object against the 'user_id' retrieved from the authentication token, the system validates the change request as legitimate.\nThis vulnerability allows an attacker to effectively hijack appointments, disable existing bookings to disrupt operations, or alter customer-facing data. Post-exploitation impact includes unauthorized control over the scheduling workflow and potential exposure of sensitive client information associated with hijacked appointments. Since the vulnerability resides within the REST API component, the exploitation is performed remotely and does not require local file access or direct database interaction, making it a high-risk vector for malicious actors aiming to disrupt or subvert the functionality of the Timetics plugin."
}