CVE-2024-11275

Summary

CVE-2024-11275 is a vulnerability affecting the WP Timetics plugin for WordPress. The issue lies in the lack of capable checks on the /wp-json/timetics/v1/customers/ REST API endpoint, which is present in all versions up to 1.0.27. This vulnerability enables authenticated attackers with Timetics Customer access or above to delete arbitrary users, leading to unauthorized loss of data.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.