CVE-2026-14326

LowCVSS 3.8

Published: 02/09/2026(UTC)Updated: 03/09/2026(UTC)Translated: 02/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Timetics WordPress plugin through version 1.0.61 does not enforce per-object ownership when updating appointments via its REST API, allowing users with the custom staff role to modify, disable, or take over appointments belonging to other staff members.

Risk Assessment

Risk of data integrity and confidentiality breach, as well as unauthorized takeover of other users' appointments.

Recommendation

Update the Timetics plugin to the latest patched version and review permissions for users with the staff role.

Other vulnerabilities in Timetics WordPress plugin

CVE-2026-14322Medium
The Timetics WordPress plugin before version 1.0.57 does not enforce a pending or unpaid status for new bookings created through a payment method other than its recognised gateways, allowing unauthenticated users to create fully-approved bookings for priced appointments without making any payment.

Original NVD description (English source)

The Timetics WordPress plugin through 1.0.61 does not enforce per-object ownership when updating appointments through its REST API, allowing users with its custom staff role to modify, disable, or take over appointments belonging to other staff members.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS