Vulnerability · Published Jun 14, 2024 · Assigned by Wordfence

CVE-2024-1094Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation

High 7.3

In plain English

A high-severity missing authorization in Timetics – Appointment Booking & Scheduling from arraytics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.5%top 54.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.

Affected products (as reported)

Vendor	Product	Versions
arraytics	Timetics – Appointment Booking & Scheduling	0 – through 1.0.21

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References