CVE-2025-5919: 
WordPress vulnerability analysis and mitigation

CVE-2025-5919 is a Missing Authorization vulnerability in the "Appointment Booking and Scheduling Calendar Plugin – WP Timetics" plugin for WordPress. Due to a missing capability check on the update and register_routes functions, unauthenticated remote attackers can view and modify booking details. All plugin versions up to and including 1.0.36 are affected. The vulnerability was published on January 6, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium), assigned by Wordfence (Wordfence, NVD).

The root cause is CWE-862 (Missing Authorization): the plugin's REST API endpoints — specifically the update function in core/bookings/api-booking.php (line 56) and the register_routes function in core/bookings/booking.php (line 592) — do not perform any capability or permission checks before processing requests. This allows any unauthenticated network attacker to call these endpoints directly and interact with booking data without authentication. No special preconditions, user interaction, or elevated privileges are required for exploitation (Wordfence, NVD).

Successful exploitation allows unauthenticated attackers to both read and modify appointment booking data stored by the plugin, resulting in limited confidentiality and integrity impacts. Sensitive information such as customer names, contact details, and appointment schedules may be exposed or tampered with. Availability is not directly impacted, but data manipulation could disrupt business operations for sites relying on the plugin for scheduling (Wordfence).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the time of publication. The EPSS score is approximately 0.045%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified (Feedly, Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP Timetics plugin (versions ≤ 1.0.36) using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/timetics/readme.txt.
2. Identify vulnerable REST API endpoints: Enumerate the plugin's registered REST API routes (e.g., via https://target.com/wp-json/ or by reviewing the plugin source at core/bookings/api-booking.php and core/bookings/booking.php).
3. Send unauthenticated read request: Issue an HTTP GET or POST request to the booking API endpoint without any authentication headers or nonces to retrieve existing booking details (customer names, contact info, appointment times).
4. Send unauthenticated modification request: Craft an HTTP request targeting the update endpoint with modified booking parameters (e.g., changed appointment time, customer details) and submit it without credentials to alter booking records.
5. Achieve objective: Confirm that booking data has been read or modified by re-querying the endpoint or checking the WordPress admin panel (Wordfence, NVD).

• Network: Unusual unauthenticated HTTP GET/POST requests to WordPress REST API endpoints associated with the WP Timetics plugin (e.g., paths containing /wp-json/timetics/ or similar booking-related routes) from unexpected IP addresses.
• Logs: WordPress access logs showing repeated REST API calls to booking endpoints without valid authentication tokens or nonces, particularly from automated or scripted sources.
• Logs: Unexpected modifications to booking records in the WordPress database (wp_posts or custom Timetics tables) with no corresponding authenticated admin session.
• File System: Presence of WP Timetics plugin version 1.0.36 or earlier in /wp-content/plugins/timetics/ (check readme.txt for version number).

Site administrators should update the WP Timetics plugin to version 1.0.37 or later, which addresses the missing capability check. If an immediate update is not possible, consider temporarily disabling the plugin or restricting access to the WordPress REST API for unauthenticated users via a web application firewall (WAF) rule or server-level configuration. Wordfence users with the premium firewall enabled receive protection against exploitation of this vulnerability (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for January 5–11, 2026, noting it as part of a broader set of plugin issues discovered that week (Wordfence Blog). No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator listings.