The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a bo

WORDPRESS

12-03-2026 03:20

CVE-2025-15473 Vulnerabilidad documentada

Sin puntuación

Tags

#wordpress

#plugin

#change

#authenticated

#allow

Descripción

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change booking's payment status and post for the "timetics-booking" custom type.

https://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-b37937156583/

Referencia

Link externo

Ver detalles

Fuente

https://nvd.nist.gov/vuln/detail/CVE-2025-15473

Resultados similares

Coincidentes en almenos en 50% de los tags

12-03-2026 CVE-2026-2687
The Reading progressbar WordPress plugin before 1.3.1 does not sanitise and escape some of its ...
Ver información

11-03-2026 CVE-2026-3534
The Astra theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `ast-page-ba...
Ver información