Skip to content
Sign in
3.8 Low

CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through…

Description

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

Affected products and versions

Product Affected versions Fixed in
Timetics 1.0 earliest → 1.0.61 No fix stated

Other CVEs of Timetics

The 3 CVEs of Timetics →
CVE-2026-14322 The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created… 5.3 Medium CVE-2025-15473 The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated… 4.3 Medium
Track this CVE