CVE-2024-11275

🗓️ 13 Dec 2024 08:24:52Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 102 Views🌐 WEB

WordPress plugin vulnerable to unauthorized data loss via REST API endpoint allowing user deletion.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2024-11275	13 Dec 202408:36	–	circl
CNNVD	WordPress plugin WP Timetics 安全漏洞	13 Dec 202400:00	–	cnnvd
Cvelist	CVE-2024-11275 WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion	13 Dec 202408:24	–	cvelist
EUVD	EUVD-2024-34018	3 Oct 202520:07	–	euvd
NVD	CVE-2024-11275	13 Dec 202409:15	–	nvd
Patchstack	WordPress Timetics plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion vulnerability	12 Dec 202420:13	–	patchstack
Positive Technologies	PT-2024-16875 · WordPress · Wp Timetics	13 Dec 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-11275	23 May 202507:50	–	redhatcve
Vulnrichment	CVE-2024-11275 WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion	13 Dec 202408:24	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 9, 2024 to December 15, 2024)	19 Dec 202417:13	–	wordfence

Vulners

Node

arraytics timeticsRange≤1.0.27wordpress

[
  {
    "vendor": "arraytics",
    "product": "Timetics – Appointment Booking & Scheduling",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.0.27",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/d68e250e-d850-4100-81db-3e3c48a3a4a1
plugins	www.plugins.trac.wordpress.org/browser/timetics/trunk/core/customers/api-customer.php
plugins	www.plugins.trac.wordpress.org/changeset

Parameter	Position	Path	Description	CWE
id	path	/wp-json/timetics/v1/customers/	Missing capability check on Timetics customers API allows authenticated attackers with Timetics Customer access and above to delete arbitrary users.	CWE-639

17 Jun 2026 06:57Current

4.4Medium risk

Vulners AI Score4.4

CVSS 3.14.3

EPSS0.00327

SSVC

CWE-639