What’s Vulnerable › Vulnerabilities
CVE-2026-14326: Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR
- Severity: low (CVSS 3.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-02 · updated 2026-09-03
- Weakness: CWE-639
Description
The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.
Affected products
- Timetics: through 1.0.61
References
Get alerted when CVE-2026-14326 or the next vulnerability affects your stack