CVE-2026-14322

MediumCVSS 5.3

Published: 22/07/2026(UTC)Updated: 22/07/2026(UTC)Translated: 23/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.14%

4th percentile - higher than 4% of all known CVEs

Summary

The Timetics WordPress plugin before version 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Risk Assessment

The risk involves revenue loss and potential abuse by unauthenticated users.

Recommendation

It is recommended to update the Timetics plugin to version 1.0.57 or later.

Other vulnerabilities in Timetics WordPress plugin

CVE-2026-14326Low
The Timetics WordPress plugin through version 1.0.61 does not enforce per-object ownership when updating appointments via its REST API, allowing users with the custom staff role to modify, disable, or take over appointments belonging to other staff members.

Original NVD description (English source)

The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS