Insufficient Authorization in Timetics Booking Plugin for WordPress
CVE-2025-15473

4.3MEDIUM

Key Information:

Vendor

WordPress
Status
Timetics
Vendor
CVE Published:
12 March 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2025-15473?

The Timetics Booking Plugin for WordPress prior to version 1.0.52 contains a vulnerability where a REST endpoint lacks necessary authorization checks. This allows unauthenticated users to manipulate the payment status and post status of bookings for the custom post type 'timetics-booking.' As a result, attackers can potentially cause disruptions to booking operations and financial transactions without proper restrictions.

Affected Version(s)

Timetics 0 < 1.0.52

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-15473 - Proof of Concept

References

https://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-...
exploitvdb-entrytechnical-description

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Khaled Alenazi (Nxploited)
WPScan
.