This vulnerability is a missing authorization flaw that allows an attacker to bypass the intended access control for the Timetics plugin. An adversary who can reach the plugin’s interfaces can read, modify, or delete data and content that should be protected, effectively elevating their privileges over the WordPress installation. The flaw can also facilitate further exploitation of the underlying system if sensitive information is exposed.

The defect is present in the Arraytics Timetics WordPress plugin in all versions from the original release up to and including 1.0.53. Users who have installed or continue to run any version of the plugin within this range are affected.

The CVSS score of 8.2 indicates high severity. Exploitation is straightforward due to the lack of proper authorization checks; an adversary only needs to issue requests to the plugin’s protected endpoints. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The easiest attack path is to send crafted HTTP requests to the plugin’s URLs and directly access or manipulate data that should be restricted. Even though the description does not state whether authentication is required, the missing authorization control inherently allows both local and remote actors to gain unauthorized access if they can reach the plugin endpoints.