CVE-2025-5919: Arraytics Timetics – Appointment Booking & Scheduling

Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days.

The Appointment Booking and Scheduling Calendar Plugin – WP Timetics plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing capability check on the update and register_routes functions in all versions up to, and including, 1.0.36. This makes it possible for unauthenticated attackers to view and modify booking details.

Affected products

• Arraytics Timetics – Appointment Booking & Scheduling: up to and including 1.0.36

Published 2026-01-06. Last modified 2026-10-07.