The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated users to arbitrarily change a booking's payment status and post status for the "timetics-booking" custom post type.CreditsKhaled Alenazi (Nxploited)WPScanReferenceshttps://wpscan.com/vulnerability/f355e4ac-7aa6-4c5b-b1e5-b37937156583/
