CVE-2025-5919: WP Timetics Auth Bypass Vulnerability

CVE-2025-5919 Overview

CVE-2025-5919 affects the Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress. The plugin fails to perform capability checks on the update and register_routes functions in all versions up to and including 1.0.36. Unauthenticated attackers can view and modify booking details through the exposed REST API endpoints. The flaw is classified as a Missing Authorization weakness [CWE-862] and stems from improper access control on booking management routes.

Critical Impact
Unauthenticated network attackers can read and modify customer booking records on affected WordPress sites running WP Timetics 1.0.36 or earlier.

Affected Products

WP Timetics – Appointment Booking and Scheduling Calendar Plugin for WordPress
All plugin versions up to and including 1.0.36
WordPress sites with the plugin installed and active

Discovery Timeline

2026-01-06 - CVE-2025-5919 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-5919

Vulnerability Analysis

The WP Timetics plugin exposes a REST API for managing appointment bookings. The update function and register_routes function in the booking API lack a capability check, so the plugin does not verify whether the request originates from an authorized user. Anyone able to reach the WordPress site over the network can call the affected endpoints without credentials. The result is unauthorized read and write access to booking records, including customer-supplied scheduling data. Because the issue is a missing authorization control rather than input validation, exploitation does not require crafted payloads or specialized tooling — a standard HTTP client is sufficient.

Root Cause

The root cause is the absence of a permission_callback enforcing capability checks on booking routes registered through the WordPress REST API. The affected code paths are referenced in the upstream source at core/bookings/api-booking.php line 56 and core/bookings/booking.php line 592. Without a capability gate such as current_user_can() tied to an appropriate role, the routes default to permitting any caller.

Attack Vector

Attackers send unauthenticated HTTP requests to the plugin's REST endpoints over the network. No user interaction, privilege, or social engineering is required. The vulnerability manifests when a request reaches the booking update handler without an authorization check, allowing the attacker to read existing booking entries or alter their contents. See the Wordfence Vulnerability Report and WordPress Timetics Booking API source for technical details.

No verified public proof-of-concept code is available. The exploitation pattern follows standard unauthenticated REST API abuse against WordPress plugins missing permission_callback enforcement.

Detection Methods for CVE-2025-5919

Indicators of Compromise

Unauthenticated HTTP requests to WordPress REST routes registered by the timetics plugin, particularly booking update endpoints.
Unexpected modifications to booking records, including changed customer data, times, or status fields without a corresponding administrator action in the audit log.
HTTP POST or PUT traffic to /wp-json/timetics/* originating from external IP addresses without prior authentication cookies.

Detection Strategies

Inspect web server access logs for requests to /wp-json/timetics/ paths lacking authentication headers or nonces.
Correlate booking database changes with WordPress user session activity to identify modifications not tied to a logged-in administrator or staff account.
Deploy a Web Application Firewall (WAF) rule that flags unauthenticated calls to the affected plugin routes.

Monitoring Recommendations

Enable WordPress audit logging to record REST API requests targeting the plugin namespace.
Forward web server and WordPress application logs to a centralized SIEM for retention and correlation.
Alert on bursts of REST API traffic to booking endpoints from a single source IP, which may indicate enumeration or bulk modification.

How to Mitigate CVE-2025-5919

Immediate Actions Required

Update the WP Timetics plugin to a version newer than 1.0.36 that includes a fix for the missing capability check.
If no patched version is available, deactivate and remove the WP Timetics plugin from affected WordPress sites.
Review booking records for unauthorized modifications and restore from clean backups where tampering is confirmed.

Patch Information

A patched release addressing the missing authorization control must be obtained from the plugin maintainers via the WordPress plugin repository. Refer to the Wordfence Vulnerability Report for the current fix status and recommended target version.

Workarounds

Restrict access to /wp-json/timetics/* endpoints at the WAF or reverse proxy layer to authenticated administrative IP ranges.
Disable the WP Timetics plugin until a patched version is installed if bookings are not business-critical.
Apply WordPress hardening rules that require authentication for all REST API requests using a plugin or filter on rest_authentication_errors.

bash

# Example WordPress filter to require authentication for REST API requests
# Add to a site-specific mu-plugin until the WP Timetics patch is applied
add_filter('rest_authentication_errors', function ($result) {
    if (!empty($result)) {
        return $result;
    }
    if (!is_user_logged_in()) {
        return new WP_Error(
            'rest_not_logged_in',
            'REST API restricted to authenticated users.',
            array('status' => 401)
        );
    }
    return $result;
});