Unknown Timetics vulnerabilities

3 CVEs affecting Unknown Timetics, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-14326, published 2026-09-02.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-14322, published 2026-07-22. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated…
CVE-2026-14326, published 2026-09-02. Low severity, CVSS 3.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or…
CVE-2025-15473, published 2026-03-12. Medium severity, CVSS 4.3. EPSS: 0.2% chance of exploitation in the next 30 days. The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the…