AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2024-9263

CRITICAL · CVSS 9.8 EPSS 1.14%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2024-10-17 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It affects WordPress. Exploitation may require the attacker to be authenticated.

CVE
CVE-2024-9263
Severity
CRITICAL
CVSS
9.8
EPSS
1.14%
WordPress

Original NVD Description

The WP Timetics- AI-powered Appointment Booking Calendar and Online Scheduling Plugin plugin for WordPress is vulnerable to Account Takeover/Privilege Escalation via Insecure Direct Object Reference in all versions up to, and including, 1.0.25 via the save() due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to reset the emails and passwords of arbitrary user accounts, including administrators, which makes account takeover and privilege escalation possible.