WP Timetics Appointment Booking Plugin Missing Authorization Vulnerability

A vulnerability exists in the WP Timetics Appointment Booking and Scheduling Calendar Plugin for WordPress, in all versions through 1.0.36. The issue arises from a missing capability check in the update and register_routes functions, allowing unauthorized access and modification of booking details. This flaw enables unauthenticated attackers to view and alter booking information.

Impact

Exploitation of this vulnerability allows for unauthorized viewing and modification of booking details.

Remediation

Users are advised to update the plugin to version 1.0.37 or a newer patched version.