CVE-2024-1094: Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation
The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the makestaff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1094?
CVE-2024-1094 has a medium severity rating due to unauthorized modification of data.
How do I fix CVE-2024-1094?
To fix CVE-2024-1094, update the Timetics Appointment Booking plugin to version 1.0.22 or later.
What versions are affected by CVE-2024-1094?
All versions of Timetics Appointment Booking up to and including 1.0.21 are affected by CVE-2024-1094.
What is the nature of the vulnerability in CVE-2024-1094?
CVE-2024-1094 allows unauthorized data modification due to a missing capability check in the make_staff() function.
Who is the vendor of the software affected by CVE-2024-1094?
The vendor of the software affected by CVE-2024-1094 is Timetics.