CVE-2026-14326CWE-639

CVE-2026-14326

Low · published September 2, 2026

CVSS v3.1
3.8
EPSS
0%
Percentile
12.4
In the wild
Unconfirmed
What it is

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

The record
Technical detail
CVSS v3.1
3.8 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00225 · 12.4th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-02T19:17Z
References (1)
https://wpscan.com/vulnerability/0e12e0d0-fcf1-4dfd-bbf3-7647fe231b26/ · [email protected]
EPSS history
Timeline
  • 04 SEP 03:38Z
    EPSS moved — → 0%
    epss
  • 02 SEP 14:16Z
    Timetics <= 1.0.61 - Staff+ Cross-Staff Appointment Modification via IDOR
    cvelistv5