The WP Timetics plugin suffers from an authorization bypass vulnerability (CWE-639) via an insecure direct object reference in the save() function. Because the plugin fails to validate a user-controlled key parameter, unauthenticated attackers can reset credentials for any user account, including those with administrative privileges. This vulnerability affects all versions up to and including 1.0.25 and has a CVSS 3.1 base score of 9.8, indicating critical severity with network attack vector, no required privileges or user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to take over any user account by resetting their email and password, including administrator accounts. This leads to full system compromise, enabling privilege escalation and complete control over the affected WordPress site.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates and avoid using the affected versions of the plugin. As a temporary mitigation, consider disabling or removing the plugin until a fix is released. Implementing strict access controls and monitoring for suspicious activity may help reduce risk but do not fully mitigate the vulnerability.