PT-2025-47435 · WordPress · Booking Plugin For Wordpress Appointments – Time Slot

Published 2025-11-19 · Updated 2025-11-19 · CVE-2025-12842

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Booking Plugin for WordPress Appointments – Time Slot versions up to and including 1.4.7

Description The software is susceptible to unauthorized email sending due to a lack of validation on the tslot appt email AJAX action. This allows unauthenticated attackers to send appointment notification emails to arbitrary recipients, with the ability to control content within certain email fields. This could potentially be used for phishing campaigns or spam distribution.

Recommendations Update The Booking Plugin for WordPress Appointments – Time Slot to a version later than 1.4.7.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-12842

Affected Products

Booking Plugin For Wordpress Appointments – Time Slot

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12842 · Security Note
• https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L23 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/087b6943-5da8-44fe-8614-832768444178?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1991076727699747263 · Twitter Post
• https://t.me/CVEtracker/37718 · Telegram Post
• https://plugins.trac.wordpress.org/browser/timeslot/tags/1.4.6/public/form/email.php#L21 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3397527%40timeslot&new=3397527%40timeslot&sfp_email=&sfph_mail= · Note
• https://twitter.com/CVEnew/status/1991042919524950314 · Twitter Post