CVE-2024-11275

WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion

4.3 Medium

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the /wp-json/timetics/v1/customers/ REST API endpoint in all versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with Timetics Customer access and above, to delete arbitrary users.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: Low
Availability: None

Exploit likelihood

0.34%Up 0.3 points since Dec 14, 2024

What each source reports

CVE List Score used 4.3

WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin <= 1.0.27 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Deletion

Record: CVE-2024-11275
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

EUVDEUVD-2024-34018 4.3

Record: EUVD-2024-34018
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-qcf7-52w8-gp39 4.3

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for...

Record: GHSA-qcf7-52w8-gp39
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

NVD 4.3

Record: CVE-2024-11275
CVSS 3.1: 4.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Weakness: CWE-639
Updated: 2026-11-02

Affected products

arraytics timetics – appointment booking & scheduling

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-11275 is a medium vulnerability (CVSS 4.3) in Arraytics Timetics – Appointment Booking & Scheduling, published December 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 27th percentile. No source names a fixed version.