CVE-2025-5919

Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification

View on CVE.org

Published Jan 6, 2026 CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Description

The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.

Analysis

Technical impact

The Timetics Appointment Booking & Scheduling plugin has a missing capability check in its update and register_routes functions in all releases up to 1.0.36. This omission allows anyone who can send a request to the plugin’s REST API endpoints to retrieve and edit booking details without authenticating, effectively exposing sensitive customer data and enabling tampering with scheduled appointments.

Affected Systems

The vulnerability affects the WP Timetics plugin developed by arraytics, covering all versions 1.0.36 and earlier. Users running any of these releases on their WordPress sites are potentially exposed.

Risk and Exploitability

The CVSS base score of 6.5 indicates moderate severity, while an EPSS score below 1% suggests a low probability of exploitation in the wild. The issue is not listed in the CISA KEV catalog, and no public exploit has been reported. Likely attack vectors involve direct REST API calls to the plugin’s endpoints, where the missing capability check allows unauthenticated access to booking data.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

arraytics

Timetics – Appointment Booking & Scheduling

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.0.36

No data.

Vendor	Product	Versions
Arraytics	Appointment Booking Calendar	—
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Timetics plugin to version 1.0.37 or later, where the capability checks have been added
If upgrading immediately is not possible, temporarily block or restrict the plugin’s REST API routes to authenticated users through WordPress role settings or custom code
Continuously monitor site logs for anomalous booking access patterns that may indicate exploitation attempts

Generated by OpenCVE AI on April 20, 2026 at 18:52 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.244% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.36/core/bookings/api-booking.php#L56
https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.36/core/bookings/booking.php#L592
https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d50b65-7479-4140-9231-c06c18d8be8f?source=cve

History

Jan 6, 2026 3:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jan 6, 2026 2:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Arraytics Arraytics appointment Booking Calendar Wordpress Wordpress wordpress
Vendors & Products		Arraytics Arraytics appointment Booking Calendar Wordpress Wordpress wordpress

Jan 6, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.
Title		Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.36/core/bookings/api-booking.php#L56 https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.36/core/bookings/booking.php#L592 https://www.wordfence.com/threat-intel/vulnerabilities/id/d8d50b65-7479-4140-9231-c06c18d8be8f?source=cve
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}`