CVE-2024-11275 is an authorization bypass vulnerability in the WP Timetics plugin for WordPress, specifically affecting the /wp-json/timetics/v1/customers/ REST API endpoint. The issue arises from a missing capability check that permits authenticated users with Timetics Customer privileges or above to delete arbitrary users. This vulnerability affects all plugin versions up to and including 1.0.27. The weakness is categorized under CWE-639, which involves authorization bypass through user-controlled keys. The CVSS 3.1 score of 4.3 indicates a medium severity with network attack vector, low attack complexity, and privileges required at the Timetics Customer level. There is no known exploit in the wild and no patch or official fix information is provided in the data.

An attacker with authenticated access at the Timetics Customer level or higher can delete arbitrary users via the vulnerable REST API endpoint. This results in unauthorized integrity loss of user data but does not affect confidentiality or availability. There is no indication of exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Timetics Customer access privileges to trusted users only and monitor for suspicious activity related to user deletions. Avoid granting unnecessary Timetics Customer level access to reduce risk.