CVE-2025-15473 — Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update

CVE-2025-15473

Timetics < 1.0.52 - Unauthenticated Payment/Booking Status Update PUBLISHED

Description (CNA)

The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.

Affected (CNA)

Vendor / product	Versions
Unknown / Timetics	affected 0 before 1.0.52

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-b37937156583/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.