CVE-2024-1094

This is like a website’s “staff settings” door that doesn’t properly check who is allowed inside. With this bug, someone might be able to grant staff-level access without logging in, which could let them tamper with your scheduling system.

This matters if you run the WordPress plugin “Timetics – Appointment Booking & Scheduling” on a public website. It is designed to be exploitable without a login or any user clicking, meaning an outside attacker can attempt it. The risk is highest if the vulnerable staff/permission feature is reachable from the internet on your site (reachability in the default configuration isn’t confirmed in the findings).

Treat this as an AMBER issue: it allows unauthenticated privilege escalation, which attackers can attempt directly over the network. There’s no known patch yet, so your priority is to verify exposure and apply available mitigations while you wait for a fixed release.

1. Confirm the plugin and version

   • Log into WordPress and check the installed plugin list for “Timetics – Appointment Booking & Scheduling.”
   • Identify the version. The vulnerable range is “all versions up to, and including, 1.0.21.”

2. Check whether the site exposes the vulnerable functionality

   • Look for any publicly reachable endpoints or actions tied to “staff” or permission changes.
   • If you have access to your hosting/WAF logs, search for unusual requests around staff/permission changes or repeated probing patterns.
   • Note: the findings do not confirm “reachable in default configuration,” so you must verify based on your site’s setup.

3. Immediate mitigations (if you’re exposed)

   • Restrict access to the WordPress admin area to only trusted networks/users (your host may offer IP allowlisting).
   • Use your web application firewall/WAF (from your host) to add rules to block suspicious traffic patterns targeting plugin-specific requests.
   • If your business can pause the plugin’s scheduling features, disable the plugin temporarily while waiting for a security update.

4. Work with the vendor/host for a fixed version

   • The findings state there is no patch/fix information available right now. Contact your plugin vendor or hosting provider and request:
     • The availability of an updated version that addresses CVE-2024-1094.
     • Any interim compensating controls they recommend for Timetics.

5. After changes

   • Monitor WordPress admin/user management activity for unexpected staff permission changes.
   • Review recent admin/account changes and booking-system behavior for anomalies.

Severity is indicated as High (CVSS 7.3). The weakness is Missing Authorization to Limited Privilege Escalation: a capability/authorization check is missing in the make_staff() function, allowing unauthenticated attackers to modify data by granting staff permissions. Attack vector is network, with no authentication and no user interaction required per the findings. KEV (CISA Known Exploited Vulnerabilities) does not list this CVE. No exploit details are provided beyond a detection-template mention, so exploit maturity beyond probing is not confirmed. EPSS is given as a low predicted likelihood (0.5%) with a flat trend, but this does not override the practical risk of unauthenticated privilege escalation. No fixed version or patch is available in the findings, so remediation depends on disabling/restricting exposure and waiting for an official update.