The vulnerability is a missing authorization issue in the Arraytics Timetics WordPress plugin. Because access control checks are incorrectly configured, an attacker who can reach the plugin’s web endpoints could perform actions without proper authentication or authorization. This flaw, identified as CWE‑862, enables unauthorized manipulation of plugin data or configuration, potentially leading to disclosure, modification, or destruction of sensitive information stored within WordPress.

Arraytics Timetics WordPress plugin users up through version 1.0.44 are affected. The flaw applies to all installations of the plugin prior to that version, regardless of the WordPress core version.

The CVSS score of 7.5 indicates a high severity, though the EPSS score is less than 1 % and it is not listed in the CISA KEV catalog, suggesting low current exploitation probability. The likely attack vector is web-based, where an attacker sends crafted HTTP requests to plugin endpoints that lack proper authorization checks. Successful exploitation requires access to the plugin’s restricted area; no local privilege escalation or network-level compromise is indicated by the current data.