Security Alert Summary
The Timetics WordPress plugin prior to version 1.0.57 fails to enforce a pending or unpaid status for bookings created via payment methods outside its recognised gateways. This allows unauthenticated users to create fully-approved bookings for paid appointments without making any payment.
CVE Details
- CVE ID: CVE-2026-14322
- Affected component: Timetics WordPress plugin
- Affected versions: Versions before 1.0.57
- Published: July 22, 2026 07:16:35 AM UTC
- Last modified: July 22, 2026 04:30:26 PM UTC
- CVSS v3.1: Base score 5.3 (MEDIUM) —
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Authentication / privileges / user interaction: No authentication or privileges required; no user interaction required
- Primary impact: Integrity: Low; Confidentiality: None; Availability: None
- Weakness (CWE): CWE-284 (Improper Access Control)
- SSVC notes: exploitation: proof of concept; automatable: yes; technical impact: partial (role: CISA Coordinator)
Technical Details
The plugin does not enforce a pending or unpaid status for new bookings when those bookings are created using a payment method that is not one of the plugin’s recognised gateways. As a result, the normal verification or payment status checks that would mark a booking as awaiting payment are not applied, and the booking may be recorded as fully approved without processing any payment.
The issue stems from missing or insufficient status enforcement on booking creation paths tied to non-recognised payment methods. The vulnerability permits unauthenticated actors to create bookings for priced appointments that bypass the intended payment requirement. The description does not name specific functions or REST endpoints.
Impact is limited to the integrity of booking records: an attacker can create approved bookings without paying. The CVSS vector indicates network attack with low complexity and no direct confidentiality or availability effects.
How This Could Impact Your Website
In a typical site setup, a site owner manages Timetics, internal staff handle appointments, and external contractors or contributors may interact with booking information. If unauthenticated actors can create approved, paid bookings, staff time and appointment slots can be consumed by fraudulent bookings, causing administrative disruption and potential revenue loss for paid services.
While the CVSS data indicates no direct confidentiality impact, this kind of booking manipulation can increase operational risk. For example, if booking workflows include notifications or display contact details, fraudulent bookings could facilitate targeted social engineering or nuisance contacts. Review your workflows to understand whether booking confirmations or notifications expose internal contacts or staff emails.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin to version 1.0.57 or later if that version is available for your site.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level and other non-administrator accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and booking logs for unusual behavior, such as a sudden increase in approved bookings from anonymous users.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
