Unauthorized Modification of Data in Timetics Appointment Booking Plugin

CVE-2024-1094

Summary

The Timetics Appointment Booking plugin for WordPress, designed to facilitate AI-powered reservations and calendar scheduling, exhibits a vulnerability that allows unauthorized data modification. This issue arises from a lack of capability validation in the make_staff() function, present in all versions up to and including 1.0.21. The vulnerability enables unauthenticated attackers to illegitimately assign staff permissions to any user, which may lead to unauthorized access and manipulation of sensitive data within the application. Organizations using this plugin should take immediate action to mitigate potential security risks.

References