The WP Timetics Appointment Booking & Scheduling plugin (by arraytics) suffers from a missing capability check in its update and register_routes functions. This lack of authorization verification enables unauthenticated users to access and alter booking information. The vulnerability is classified under CWE-862 (Missing Authorization) and affects all plugin versions up to 1.0.36. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality and integrity impact.

An attacker without authentication can view and modify booking details within the affected plugin, potentially leading to unauthorized disclosure and alteration of sensitive scheduling data. There is no indication of availability impact. No known exploits are currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's endpoints where possible and monitor for suspicious activity related to booking modifications. Avoid exposing the plugin to untrusted networks or users.