CVE-2024-1094

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, and including, 1.0.21. This makes it possible for unauthenticated attackers to grant users staff permissions. CVE-2024-37427 is likely a duplicate of this issue.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published
Jun 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-109405.3A vulnerability in langchain-core versions >=0.1.17,<0.1.53, >=0.2.0,<0.2.43, and >=0.3.0,<0.3.15 allows unauthorized users to read arbitrarCVE-2024-109416.5A malicious website could have included an iframe with an malformed URI resulting in a non-exploitable browser crash. This vulnerability affCVE-2024-109427.5The All-in-One WP Migration and Backup plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 7.89CVE-2024-109439.1An authentication bypass vulnerability exists in the affected product. The vulnerability exists due to shared secrets across accounts and coCVE-2024-109448.4A Remote Code Execution vulnerability exists in the affected product. The vulnerability requires a high level of permissions and exists due CVE-2024-109457.3A Local Privilege Escalation vulnerability exists in the affected product. The vulnerability requires a local, low privileged threat actor tCVE-2024-109467.2A vulnerability classified as critical has been found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster AutomatioCVE-2024-109477.2A vulnerability classified as critical was found in Guangzhou Tuchuang Computer Software Development Interlib Library Cluster Automation ManCVE-2024-109486.5A vulnerability in the upload function of binary-husky/gpt_academic allows any user to read arbitrary files on the system, including sensitiCVE-2024-10955.3The Build & Control Block Patterns – Boost up Gutenberg Editor plugin for WordPress is vulnerable to unauthorized access of data due to a miCVE-2024-109508.8In binary-husky/gpt_academic version <= 3.83, the plugin `CodeInterpreter` is vulnerable to code injection caused by prompt injection. The rCVE-2024-109527.3The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via update_authors_list_ajax AJAX action in all ver