Description
The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Timetics | < 1.0.52 | 1.0.52 |
References
- https://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-b37937156583/ exploit vdb-entry technical-description