CVE-2024-1094

Name of the Vulnerable Software and Affected Versions The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress versions up to, and including, 1.0.21

Description The issue is related to a missing capability check on the make staff() function, allowing unauthenticated attackers to grant users staff permissions, thus enabling unauthorized modification of data.

Recommendations For versions up to, and including, 1.0.21, update to a version that includes a fix for the missing capability check on the make staff() function to prevent unauthorized modification of data. As a temporary workaround, consider disabling the make staff() function until a patch is available.