The Timetics WordPress plugin contains a missing capability check in the make_staff() function, which leads to unauthorized modification of user permissions. Specifically, unauthenticated attackers can escalate privileges by assigning staff roles to users without proper authorization. This issue affects all versions up to 1.0.21 and is tracked as CVE-2024-1094 with a CVSS 3.1 base score of 7.3 (high). No patch or official remediation has been documented at this time.

Successful exploitation allows unauthenticated attackers to grant staff permissions to users, potentially enabling unauthorized access to restricted functionality or data within the plugin environment. This can lead to confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:L/I:L/A:L).

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin and monitor for suspicious activity related to user role changes. Avoid installing or updating to vulnerable versions and consider disabling the plugin if feasible.