CVE-2026-97304

Executive Summary

CVE-2026-97304 is a Missing Authorization (CWE-862) vulnerability in the Arraytics Timetics plugin, affecting all versions up to and including 1.0.63. The flaw stems from incorrectly configured access control security levels, allowing an unauthenticated remote attacker to invoke functionality that should require authorization. Successful exploitation yields low integrity and availability impact; there is currently no public proof-of-concept, no Nuclei template, and no patch available (Patch Confidence 0/4).

Technical Analysis

The vulnerability is classified under CWE-862: Missing Authorization. Per the NVD description, the root cause is "Exploiting Incorrectly Configured Access Control Security Levels" affecting Timetics "from n/a through 1.0.63." In practical terms, CWE-862 denotes that one or more executable code paths process a request without performing an authorization check against the caller's identity or role. When access control is "incorrectly configured," the affected functionality is reachable by principals who should have been denied — in the worst case, by unauthenticated network clients.

The CVSS v3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L, which carries several analytically significant properties:

• AV:N — the vulnerable component is reachable over the network.
• AC:L — no special conditions beyond a standard request are required.
• PR:N — no privileges or authentication are prerequisites, meaning the authorization check is either absent or bypassable without credentials.
• UI:N — no victim interaction is required.
• S:U — impact is scoped to the vulnerable component.
• C:N / I:L / A:L — confidentiality is not directly impacted; integrity and availability impacts are rated Low, consistent with an attacker being able to trigger state-changing (integrity) or resource-consuming (availability) operations without authorization, but not to disclose protected data.

Timetics is a WordPress-ecosystem plugin (Arraytics is a WordPress plugin vendor). WordPress plugins typically expose functionality through registered REST API endpoints, admin-ajax.php actions, or shortcode/form handlers. Because the description identifies the flaw as missing authorization with PR:N, the most probable attack surface is a publicly reachable entry point (REST route or AJAX action) whose callback lacks a capability check such as current_user_can() or a nonce/authorization validation. The NVD description and CNA title do not disclose the specific endpoint, action name, parameter, or function involved; those implementation specifics are not asserted here. Any statement of exact routes or handlers would be speculative.

The vulnerable population is bounded by the version constraint "through 1.0.63"; the exact minimum affected version is not provided ("from n/a"). Because there is no fixed version, the entire known release line up to and including 1.0.63 must be treated as affected.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template exists for CVE-2026-97304. The attack chain below is inferred strictly from the vulnerability class (CWE-862, Missing Authorization) and the provided CVSS characteristics. No specific endpoints, parameters, or function names from the plugin are asserted because none are present in the source data.

1. Reconnaissance / target identification. An attacker enumerates internet-facing hosts running the WordPress Timetics plugin. Fingerprinting is performed via HTTP response body content referencing the plugin path (wp-content/plugins/timetics), plugin-specific page markup, or plugin asset references. Mass scanning services and search engines indexed with dorks such as http.html:"timetics" or http.html:"wp-content/plugins/timetics" can identify candidate targets at scale without authentication (consistent with PR:N and UI:N).

2. Triggering the missing authorization condition. Because the flaw is a missing/incorrect authorization check, the attacker sends a crafted request directly to the affected component's entry point. The defining characteristic is that the request succeeds without an authenticated session, valid nonce, or elevated role. In WordPress plugin architectures this request is commonly an HTTP GET or POST to a REST route under /wp-json/ or to /wp-admin/admin-ajax.php with a plugin-specific action — the general mechanism for reaching plugin code that fails to enforce a capability check. The attacker does not need to defeat authentication; the authorization layer is simply absent on the reachable path.

3. Payload / execution method (class-level). For CWE-862, the "payload" is not memory-corruption shellcode but a syntactically valid request to the unprotected operation. Depending on what the unprotected handler performs, this manifests as an unauthorized state change (I:L) or a resource-consuming operation (A:L). Because confidentiality is rated None (C:N), the flawed path is not expected to return protected data; the observable effect is modification of plugin-managed state or exhaustion of a resource. The precise request shape cannot be reproduced from the available data and is not fabricated here.

4. Post-exploitation impact. With S:U and I:L/A:L, impact is bounded to the Timetics component: unauthorized writes/state changes and/or limited availability degradation within that component. The attacker gains no direct confidentiality of protected data and no authenticated foothold via this vector alone. However, unauthenticated, low-complexity authorization bypasses on public WordPress plugins are frequently chained — e.g., altering plugin data to enable a secondary injection or stored-content vector — so the practical risk may exceed the isolated CVSS subscores if chained.

Impact Assessment

CVSS v3.1 base score is 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L.

• Exploitability is high per the vector: AV:N + AC:L + PR:N + UI:N indicate the flaw is remotely reachable, requires no credentials, needs no user interaction, and demands only trivial conditions. This is the dominant driver of the score.
• Impact is limited: Scope is Unchanged; Confidentiality is None; Integrity and Availability are each Low. The vulnerability does not expose sensitive data per the assigned rating, but permits unauthorized modification and/or degradation of plugin functionality.
• Blast radius: Any WordPress site running the Timetics plugin at version ≤ 1.0.63 with the affected functionality exposed to the network. Because there is no patch (Patch Confidence 0/4), every deployed instance up to that version remains exposed until the vendor releases a fix or an administrator removes/disables the plugin.
• EPSS: Not yet scored by FIRST.org — no EPSS value is asserted.
• CISA KEV: Not listed. No known exploitation in the wild is documented in the provided intelligence.
• Business considerations: For content/branding sites the impact is contained to the plugin's data and availability. For sites where Timetics enforces business rules or customer-facing scheduling/content flows, unauthorized modification (I:L) could translate to data-integrity and trust costs. Full-scope breach risk is not supported by the ratings, but unpatched public-plugin authorization gaps remain attractive reconnaissance targets.

Detection Guidance

Because the specific request signature is unknown, detections below target the behavioral class: unauthenticated or low-privilege access to Timetics plugin endpoints and anomalous state-changing activity. They are written generically and should be tuned to the site's baseline.

Sigma Rule

title: Potential Arraytics Timetics Missing Authorization Exploitation (CVE-2026-97304)
id: 6f2c9a1e-4b7d-4c2a-9e10-timetics97304
status: experimental
description: Detects unauthenticated or low-privileged requests to Timetics plugin endpoints consistent with CWE-862 authorization bypass (CVE-2026-97304).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97304
author: valtersit.com
date: 2026-01-01
tags:
  - attack.t1190
  - cve.2026-97304
logsource:
  category: webserver
  product: apache
detection:
  selection_plugin:
    cs-uri-query|contains:
      - 'timetics'
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_status:
    sc-status:
      - 200
      - 302
  filter_auth:
    cs-uri-query|contains: 'wp-admin'
  condition: selection_plugin and selection_method and selection_status and not filter_auth
falsepositives:
  - Legitimate front-end interaction with Timetics schedule/booking features
  - Caching and health-check requests
level: medium

YARA Rule

rule CVE_2026_97304_Timetics_Missing_Authorization
{
    meta:
        description = "Detects Timetics plugin artifacts referenced in web logs or cached responses for CVE-2026-97304 authorization-bypass activity"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97304"
        date = "2026-01-01"
        cve = "CVE-2026-97304"

    strings:
        $plugin_path = "wp-content/plugins/timetics" ascii nocase
        $plugin_slug = "timetics" ascii nocase
        $ajax = "admin-ajax.php" ascii nocase
        $rest  = "wp-json" ascii nocase

    condition:
        $plugin_path or ($plugin_slug and ($ajax or $rest))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-97304 Possible Arraytics Timetics Missing Authorization Attempt"; flow:established,to_server; http.uri; content:"timetics"; nocase; http.method; content:"GET"; http.method; content:"POST"; pcre:"/(wp-json|admin-ajax\.php)/Ui"; threshold:type both, track by_src, count 20, seconds 60; classtype:attempted-recon; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97304; sid:202697304; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=60s
  [ network where http.request.method == "POST" and
      network.protocol == "http" and
      wildcard(url.path, "*timetics*") ]
  [ network where http.response.status_code == 200 and
      wildcard(url.path, "*timetics*") ]

Splunk SPL Query

index=web sourcetype=access_combined
| eval is_timetics=if(like(_raw,"%timetics%"),1,0)
| where is_timetics=1
| eval unauth=if((match(uri_path,"(?i)(wp-json|admin-ajax)") OR match(uri_query,"(?i)action=")),1,0)
| stats count values(uri_path) as paths values(status) as statuses by src_ip, unauth, uri_path
| where unauth=1 AND (status=200 OR status=302)
| where count > 10
| sort - count
| table src_ip, uri_path, statuses, count

Wazuh OSSEC Rule

<group name="web,wordpress,timetics,">
  <rule id="100973" level="10">
    <if_sid>31100,31101,31103,31104,31105,31106,31107,31108</if_sid>
    <match>timetics</match>
    <regex>(wp-json|admin-ajax\.php)</regex>
    <description>CVE-2026-97304: Possible unauthenticated access to Timetics plugin endpoint (authorization bypass)</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97304,</group>
  </rule>
  <rule id="100974" level="12">
    <if_sid>100973</if_sid>
    <regex> (200|302) </regex>
    <description>CVE-2026-97304: Timetics endpoint responded to unauthenticated request - likely exploitation</description>
    <group>cve_2026_97304,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No fixed version, vendor advisory, or workaround is currently available for CVE-2026-97304.

1. Immediate mitigations

   • If the plugin is not business-critical, deactivate and remove Timetics until a patched release exists; deactivation eliminates the network-reachable attack surface entirely.
   • If it must remain active, restrict access to the affected functionality at the edge: block or rate-limit requests to Timetics-specific paths and to wp-json/admin-ajax.php from untrusted sources, and apply WAF rules matching the detection signatures above.
   • Enforce authentication at the perimeter where feasible (HTTP auth, IP allow-listing for administrative/AJAX surfaces) and review whether any Timetics functionality is exposed to anonymous users that does not need to be.
   • Harden WordPress generally: disable XML-RPC where unused, minimize plugins, and keep a maintained backup for rapid rollback if compromised.

2. Patch / upgrade steps

   • Monitor the Arraytics Timetics plugin page and the NVD entry for CVE-2026-97304 for a fixed version. No patched version is referenced at this time; do not assume any release ≤ 1.0.63 is fixed.
   • When a fix is published, stage it in a test environment, verify plugin functionality, then roll out production-wide. Re-validate that all instances previously on ≤ 1.0.63 are upgraded.
   • Because no fixed version exists, treat "upgrade to latest" as not yet a remediation — verify any new version explicitly addresses CVE-2026-97304.

3. Long-term hardening

   • Establish continuous software-composition monitoring for WordPress plugins so authorization-class CVEs (CWE-862) are flagged and tracked to remediation.
   • Adopt a least-privilege posture for plugin functionality and remove unused features to shrink the authorization-bypass surface.
   • Implement logging and alerting for unauthenticated state-changing requests (the detection rules above) and routinely review plugin endpoint access.
   • Maintain an inventory of exposed plugin endpoints (REST routes, AJAX actions) and periodically audit them for missing capability checks and nonce validation.
   • Track EPSS and CISA KEV for this CVE so prioritization updates as new intelligence emerges.

References

• NVD — CVE-2026-97304: https://nvd.nist.gov/vuln/detail/CVE-2026-97304
• MITRE CWE-862 — Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• FIRST EPSS (CVE not yet scored): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE-2026-97304 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Arraytics — Timetics plugin (vendor product page; consult for any future fixed release): https://wordpress.org/plugins/timetics/

No threat actor campaigns or exploit-in-the-wild activity are associated with CVE-2026-97304 in the provided intelligence; no public PoC, exploit code, or Nuclei template is available.