PT-2024-16875 · WordPress · Wp Timetics

Thanh Nam Tran · Published 2024-12-13 · Updated 2024-12-13 · CVE-2024-11275

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Timetics - AI-powered Appointment Booking Calendar and Online Scheduling Plugin versions up to, and including, 1.0.27

Description The issue concerns a missing capability check on the "/wp-json/timetics/v1/customers/" REST API endpoint. This allows authenticated attackers with Timetics Customer access and above to delete arbitrary users, resulting in unauthorized loss of data.

Recommendations For versions up to, and including, 1.0.27, update to a version higher than 1.0.27 to resolve the issue. As a temporary workaround, consider restricting access to the "/wp-json/timetics/v1/customers/" endpoint until a patch is available. Restrict Timetics Customer access and above to minimize the risk of exploitation.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2024-11275

Affected Products

Wp Timetics

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-11275 · Security Note
• https://t.me/cvedetector/12850 · Telegram Post
• https://twitter.com/CVEnew/status/1867537595816697963 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3206505%40timetics&new=3206505%40timetics&sfp_email=&sfph_mail=#file199 · Note
• https://t.me/cvenotify/104145 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/d68e250e-d850-4100-81db-3e3c48a3a4a1?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1867638966314237999 · Twitter Post
• https://plugins.trac.wordpress.org/browser/timetics/trunk/core/customers/api-customer.php#L308 · Note