CVE-2026-97304

The Arraytics Timetics WordPress plugin (versions

EUVD-2026-92584

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

CVE-2026-97304 WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63...

WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by dcs in WordPress Plugin Timetics versions = 1.0.63...

CVE-2026-84215

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84215 WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84215

CVE-2026-84215 affects the WordPress Timetics plugin in versions 1.0.61 and earlier . The vulnerability is an unauthenticated Broken Access Control flaw, rated CVSS 6.5 (Medium) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L. This means an unauthenticated network-based attacker can exploit ...

EUVD-2026-70591

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84215 WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

WordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by NamDang in WordPress Plugin Timetics versions = 1.0.61...

PT-2026-85093

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-84215: Missing Authorization

Unauthenticated Broken Access Control in Timetics = 1.0.61 versions...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326

The Timetics WordPress plugin through 1.0.61 fails to enforce per-object ownership when updating appointments via its REST API . This allows users holding the plugin's custom staff role to modify, disable, or take over appointments belonging to other staff members. The vulnerability is classified...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

EUVD-2026-70034

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326 Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14326: Authorization Bypass Through User-Controlled Key

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

PT-2026-84719

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members...

CVE-2026-14322

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment...