Critical severity · published Oct 17, 2024
CVE-2024-9263
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.25 - Insecure Direct Object Reference to Unauthenticated Arbitrary User Password/Email Reset/Account Takeover
9.8
CVSS
1.1%
EPSS
No
On KEV
Description
The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.1% · higher than 66% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TA
Timetics – Appointment Booking & Scheduling · arraytics
through 1.0.25 · source: vendor
TI
Timetics · Arraytics
through 1.0.25 · source: CISA
Affected product
TA
Timetics – Appointment Booking & Scheduling
arraytics
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-9263
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-9263
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/timetics/tags/1.0.25/core/customers/customer.php#L299
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3169771/timetics/trunk/core/customers/api-customer.php
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3169771/timetics/trunk/core/customers/customer.php
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/74bd595b-d2fa-4c62-82d2-dba2c2b128f0?source=cve
More from Timetics – Appointment Booking & Scheduling
7.3
CVE-2024-1094
Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation
6.5
CVE-2025-5919
Appointment Booking and Scheduling Calendar Plugin – WP Timetics <= 1.0.36 - Missing Authorization to Unauthenticated Booking Details View And Modification
4.3
CVE-2024-11275
WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion