CVE-2026-14322: Timetics WordPress Auth Bypass Flaw

CVE-2026-14322 Overview

CVE-2026-14322 affects the Timetics appointment booking plugin for WordPress in versions before 1.0.57. The plugin fails to enforce a pending or unpaid status for bookings created through payment methods outside its recognised gateways. Unauthenticated attackers can create fully-approved bookings for priced appointments without submitting any payment. The flaw is classified under [CWE-284: Improper Access Control] and represents a business logic failure in the booking workflow. Site operators using Timetics for paid services face potential revenue loss and calendar abuse from attackers reserving slots without payment.

Critical Impact
Unauthenticated users can bypass the payment gateway check and obtain confirmed bookings for paid appointments, leading to lost revenue and calendar exhaustion.

Affected Products

Timetics WordPress plugin versions prior to 1.0.57
WordPress sites offering priced appointments through Timetics
Any Timetics deployment exposing booking endpoints to unauthenticated visitors

Discovery Timeline

2026-07-22 - CVE CVE-2026-14322 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-14322

Vulnerability Analysis

The Timetics plugin exposes a booking creation endpoint that accepts a payment method identifier from the client. When the submitted payment method matches one of the plugin's recognised gateways such as Stripe or PayPal, the booking is created in a pending state and only confirmed after successful payment callback. The vulnerability arises because the plugin does not apply the same state machine to unrecognised or arbitrary payment method values. Submitting a payment method string that falls outside the whitelist causes the plugin to skip the pending status assignment and mark the booking as approved. Attackers require no authentication and no user interaction to trigger this behavior over the network.

Root Cause

The root cause is missing default-deny logic in the booking status assignment routine. The code path explicitly handles known gateways but treats any other input as a valid non-gateway transaction rather than rejecting it. This is an authorization and business logic failure rather than a memory or injection issue. The plugin trusts client-supplied payment method values without verifying that a corresponding successful transaction exists.

Attack Vector

An attacker sends a crafted HTTP request to the Timetics booking REST API endpoint. The request includes a valid appointment identifier and a payment method value that does not match any registered gateway. The plugin creates the booking record with an approved status, reserving the appointment slot without collecting payment. The attack can be automated to exhaust available time slots or defraud sites offering paid consultations.

Refer to the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-14322

Indicators of Compromise

Booking records in the Timetics database with status = approved but no corresponding transaction record in the payments table
HTTP POST requests to Timetics booking REST routes containing unfamiliar or empty payment_method values
Unexpected volume of confirmed bookings from unauthenticated sessions or repeated source IPs

Detection Strategies

Query the Timetics bookings table for approved entries lacking matching gateway transaction IDs
Enable WordPress request logging and inspect payloads to the booking creation endpoint for non-standard payment method identifiers
Correlate booking creation timestamps with payment gateway webhook receipts to identify orphaned approvals

Monitoring Recommendations

Alert on spikes in booking creation volume outside normal business patterns
Monitor web server access logs for repeated POST requests to /wp-json/timetics/ booking routes from single source addresses
Track approved-to-paid booking ratios and flag deviations from historical baselines

How to Mitigate CVE-2026-14322

Immediate Actions Required

Update the Timetics plugin to version 1.0.57 or later on all WordPress installations
Audit existing bookings for approved records without corresponding payment transactions and reconcile or cancel them
Restrict access to booking endpoints behind a web application firewall rule until patching is complete

Patch Information

The vendor addressed the issue in Timetics version 1.0.57 by enforcing pending status for any booking not tied to a recognised payment gateway. Administrators should apply the update through the WordPress plugin manager or by replacing the plugin files manually. Verify the installed version under Plugins after upgrading.

Workarounds

Disable the Timetics plugin until the patched version is deployed if paid bookings are in use
Configure only recognised payment gateways within the Timetics settings and remove any custom or offline payment options
Deploy a WAF rule blocking POST requests to Timetics booking endpoints where the payment_method parameter is not on an explicit allow list

bash

# WAF rule example blocking non-whitelisted payment methods
SecRule REQUEST_URI "@contains /wp-json/timetics/" \
  "chain,deny,status:403,id:1014322,msg:'Timetics booking payment method not allowed'"
  SecRule ARGS:payment_method "!@rx ^(stripe|paypal)$"