The vulnerability is a broken access control flaw in the WordPress Timetics plugin that allows an attacker to bypass normal authorization checks. This flaw can enable the attacker to perform actions that should be restricted to privileged users, including potentially viewing or modifying protected content created or managed by the plugin. The weak point is a missing or improperly enforced authorization mechanism, exposing the affected plugin to unauthorized manipulation of its data.

Affected are all installations of the Arraytics Timetics WordPress plugin from the earliest release up to and including version 1.0.63. Any WordPress site running this plugin without the newer patched release is exposed.

The CVSS score of 6.5 ranks this flaw as having a moderate impact, while the EPSS score is not available. Because the plugin operates within the WordPress web application, the likely attack vector is remote via crafted HTTP requests to the plugin’s endpoints. The flaw is not currently listed in the CISA KEV catalog and no immediate exploit is documented, but the absence of a proper authorization layer makes exploitation straightforward for an attacker who can reach the site.