Aller au contenu
Se connecter
3.8 Faible

CVE-2026-14326 The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through…

Description

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

Produits et versions touchés

Produit Versions touchées Corrigé en
Timetics 1.0 premières → 1.0.61 Pas de correctif indiqué

Autres CVE de Timetics

Les 3 CVE de Timetics →
CVE-2026-14322 The Timetics WordPress plugin before 1.0.57 does not enforce a pending or unpaid status for new bookings created… 5.3 Moyenne CVE-2025-15473 The Timetics WordPress plugin before 1.0.52 does not have authorization in a REST endpoint, allowing unauthenticated… 4.3 Moyenne
Suivre cette CVE