The vulnerability is an authentication bypass that permits an attacker to abuse authentication controls by following an alternate path or channel. This allows unauthorized users to masquerade as legitimate administrators or to gain elevated privileges, thereby exposing the site to compromised confidentiality, integrity, and availability. The weakness is classified as CWE-288, which relates to improper authorization enforcement.

This issue affects the Arraytics Timetics WordPress plugin for versions up to and including 1.0.46. Any WordPress installation that has Timetics 1.0.46 or earlier is potentially vulnerable.

The CVSS score of 8.8 denotes a high severity flaw, yet the EPSS score of < 1% indicates a very low current exploitation probability and the vulnerability is not listed in the CISA KEV catalog. Attackers could exploit the plugin by navigating an alternative authentication route, potentially gaining unauthorized access to the admin interface. The lack of a published exploit does not guarantee safety, but the risk is mitigated by the low likelihood of exploitation and the availability of remediation.