Timetics WordPress Plugin Unauthenticated Booking Status Update Vulnerability

A vulnerability exists in the Timetics WordPress plugin in versions prior to 1.0.52, where a REST endpoint lacks proper authorization. This flaw allows unauthenticated users to arbitrarily modify a booking's payment status and post status for the 'timetics-booking' custom post type.

Impact

Exploitation of this vulnerability allows for unauthorized changes to booking payment and post statuses, potentially leading to fraudulent activity or mismanagement of bookings.

Reproduction

To reproduce this vulnerability, send a POST request to the WordPress site's REST API at '/wp-json/timetics/v1/bookings/{booking_id}/payment'. Include a JSON payload with the desired payment status, payment method, and payment details. Replace '{booking_id}' with the ID of the booking to be modified.

Remediation

Users are advised to update the Timetics WordPress plugin to version 1.0.52 or later.